Q. Who turned off the PII filter, and when? Which log, and why not invocation logging?
A. CloudTrail: it records control-plane API calls such as guardrail updates and logging-config changes, with caller identity and timestamp. Invocation logging records what the model said, not who changed the configuration.
Why? Separate the who-changed-the-system record (CloudTrail) from the what-the-model-did record (invocation logging).