diff --git a/docs/plans/2026-05-20-auditlog-m7-central-ui.md b/docs/plans/2026-05-20-auditlog-m7-central-ui.md
new file mode 100644
index 0000000..ba2765a
--- /dev/null
+++ b/docs/plans/2026-05-20-auditlog-m7-central-ui.md
@@ -0,0 +1,31 @@
+# Audit Log #23 — M7 Central UI Implementation Plan
+
+> **For Claude:** subagent-driven-development with bundled cadence.
+
+**Goal:** User-visible Audit Log page in the Central UI: filter bar, results grid with keyset paging, drilldown drawer with JSON pretty-print + cURL + redaction badges, drill-ins from Notifications/Site Calls/External Systems/Inbound API Keys/Sites/Instances, 3 KPI tiles on Health dashboard, server-side streaming CSV export, OperationalAudit+AuditExport permission gating, Playwright E2E.
+
+**UI memory constraints (locked):**
+- Blazor Server + Bootstrap CSS only. NO third-party UI libraries (no Blazorise, MudBlazor, Radzen, Prism.js, Highlight.js, etc.).
+- Custom Blazor components for tables/grids/forms.
+- Clean corporate aesthetic.
+- Form layout: vertical stacking, read-only fields first, subsections stacked, buttons at bottom.
+- Use the frontend-design skill IF dispatched UI-design subagents need pattern guidance.
+
+**M6 realities baked in:**
+- `IAuditCentralHealthSnapshot` aggregates CentralAuditWriteFailures + AuditRedactionFailure + per-site stalled. Health tiles read this.
+- `SiteHealthReport.SiteAuditBacklog` ready for per-site display.
+- `IAuditLogRepository.QueryAsync` keyset-paged; data source for the grid.
+- Pre-existing `Components/Pages/Monitoring/AuditLog.razor` (IAuditService config-change viewer) must be renamed → `Components/Pages/Audit/ConfigurationAuditLog.razor` with route `/audit/configuration`. Old route returns 404 (no redirect — internal tool, no external bookmarks).
+- Need to add `OperationalAudit` + `AuditExport` permission strings.
+
+**SQL highlighting decision:** no third-party highlighter. Render `<pre><code>` block with `language-sql` class and let any future CSS theme it; semantic markup is preserved without JS dependency.
+
+**Bundles:**
+- Bundle A — Page scaffold + nav + ConfigurationAuditLog rename (T1, T9)
+- Bundle B — Filter bar + results grid (T2, T3)
+- Bundle C — Drilldown drawer (T4, T5, T6, T7, T8)
+- Bundle D — Drill-ins from other pages (T10, T11, T12)
+- Bundle E — Health dashboard KPI tiles (T13)
+- Bundle F — CSV export (T14)
+- Bundle G — Permissions (T15)
+- Bundle H — Playwright E2E (T16)