diff --git a/api/server/routes/admin/audit.js b/api/server/routes/admin/audit.js
index b21287e7ac..e94867631e 100644
--- a/api/server/routes/admin/audit.js
+++ b/api/server/routes/admin/audit.js
@@ -7,7 +7,7 @@ const db = require('~/models');
 
 const router = express.Router();
 
-const requireAdminAccess = requireCapability(SystemCapabilities.ACCESS_ADMIN);
+const requireAuditLogRead = requireCapability(SystemCapabilities.READ_AUDIT_LOG);
 
 const handlers = createAdminAuditLogHandlers({
   listAuditLogPage: db.listAuditLogPage,
@@ -15,7 +15,7 @@ const handlers = createAdminAuditLogHandlers({
   streamAuditLogEntries: db.streamAuditLogEntries,
 });
 
-router.use(requireJwtAuth, requireAdminAccess);
+router.use(requireJwtAuth, requireAuditLogRead);
 
 router.get('/', handlers.listAuditLog);
 router.get('/export.csv', handlers.exportAuditLogCsv);
diff --git a/packages/data-schemas/src/admin/capabilities.ts b/packages/data-schemas/src/admin/capabilities.ts
index 7a966c0062..33a6c2ecf9 100644
--- a/packages/data-schemas/src/admin/capabilities.ts
+++ b/packages/data-schemas/src/admin/capabilities.ts
@@ -42,6 +42,12 @@ export const SystemCapabilities = {
   /** Reserved — not yet enforced by any middleware. */
   READ_ASSISTANTS: 'read:assistants',
   MANAGE_ASSISTANTS: 'manage:assistants',
+  /**
+   * Required to list, view, and CSV-export the SystemGrant audit log. Append-only
+   * by design, so there is no MANAGE counterpart — modifying historical entries
+   * would defeat the forensic guarantee.
+   */
+  READ_AUDIT_LOG: 'read:audit_log',
 } as const;
 
 /**
@@ -224,6 +230,10 @@ export const CAPABILITY_CATEGORIES: CapabilityCategory[] = [
   {
     key: 'system',
     labelKey: 'com_cap_cat_system',
-    capabilities: [SystemCapabilities.ACCESS_ADMIN, SystemCapabilities.READ_USAGE],
+    capabilities: [
+      SystemCapabilities.ACCESS_ADMIN,
+      SystemCapabilities.READ_USAGE,
+      SystemCapabilities.READ_AUDIT_LOG,
+    ],
   },
 ];