diff --git a/.planning/todos/pending/admin-action-audit-log.md b/.planning/todos/pending/admin-action-audit-log.md
new file mode 100644
index 00000000..ce0ff7cf
--- /dev/null
+++ b/.planning/todos/pending/admin-action-audit-log.md
@@ -0,0 +1,11 @@
+---
+title: Audit-log admin action runs with the admin id (toolbar actions)
+date: 2026-10-16
+priority: low
+area: cabana / admin
+g15office: xkujbsv4
+---
+
+cabana logs bulk action runs with `admin_id` (`modules/cabana/actions.go:166`), but a toolbar action such as pgsub's `sync_all_to_stripe` only logs failures (`runAction`, `actions.go:277-315`). A successful run leaves no record of which administrator triggered it; pgsub's per-plan "plan synced" line has no admin id.
+
+Found by the Phase 18.1 security audit (T-18.1-22, accepted as AR-18.1-03 in `.planning/phases/18.1-payment-gateway-subscriptions/18.1-SECURITY.md`). Options the user named: a separate audit-log plugin, or extending cabana so every action run (toolbar, bulk, record) is logged or emitted as an event with the admin id, action name and controller.