An audit trail is a chronological record of who did what and when: door openings, credential changes, video exports and configuration edits. In a security system it is the evidence that a control was actually applied, and it only helps if it captures identity, action, time, source and result, and cannot be quietly altered.
Logs are easy to collect and easy to ignore. An audit trail earns its name when someone can read it after an incident and reconstruct a sequence of events without guessing.
What it has to capture
At minimum the identity, the action, the object, the time and the outcome, including denials. Door events should record both the credential and the decision. Administrative changes deserve the same treatment, because disabling a camera or deleting a user is also an event worth seeing later.
Retention and review
A trail nobody keeps is not a trail. Set a retention period longer than the review cycle, protect the store from casual edits, and check the clock source so timestamps line up with video. Reading the log on a schedule is how a site finds the door that is being propped open.