diff --git a/plugins/computers/api/routes.py b/plugins/computers/api/routes.py
index d90d1c36..c455f32d 100644
--- a/plugins/computers/api/routes.py
+++ b/plugins/computers/api/routes.py
@@ -258,13 +258,42 @@ def _computer_access_links(comp, domain=None):
     return links
 
 
+def _ip_comtype():
+    """The 'IP' communication type, created if this site has none.
+
+    Both the create and the update path did `if ip_comtype:` and silently did
+    nothing when the row was missing - so a person typed an address, saved, got
+    a 200, and the address was gone. A missing reference row is a seeding gap,
+    not a reason to discard what somebody typed.
+    """
+    comtype = CommunicationType.query.filter_by(comtype='IP').first()
+    if comtype is None:
+        comtype = CommunicationType(comtype='IP', description='IP address')
+        db.session.add(comtype)
+        db.session.flush()
+    return comtype
+
+
 def _sync_access_methods(comp, data):
     """Replace a computer's enabled protocols from data['accessmethods'] (a list
     of {protocolid, portoverride?}). No-op if the key is absent, so callers that
-    don't touch access aren't affected."""
+    don't touch access aren't affected.
+
+    Returns a {'old': [...], 'new': [...]} change entry when the set actually
+    moved, or None. The caller records it: which remote-access protocols reach
+    a shop-floor PC, and on which ports, is exactly the kind of change an audit
+    log exists to remember, and this wrote nothing at all.
+    """
     if 'accessmethods' not in data:
-        return
+        return None
     desired = data.get('accessmethods') or []
+
+    def describe(rows):
+        return sorted('%s:%s' % (row.protocolid, row.portoverride or 'default')
+                      for row in rows)
+
+    before = describe(ComputerAccess.query.filter_by(
+        computerid=comp.computerid).all())
     ComputerAccess.query.filter_by(computerid=comp.computerid).delete()
     seen = set()
     for m in desired:
@@ -287,6 +316,13 @@ def _sync_access_methods(comp, data):
             isactive=True,
         ))
 
+    db.session.flush()
+    after = describe(ComputerAccess.query.filter_by(
+        computerid=comp.computerid).all())
+    if before != after:
+        return {'old': before, 'new': after}
+    return None
+
 
 # =============================================================================
 # Computers CRUD
@@ -587,7 +623,7 @@ def create_computer():
 
     # Optional primary IP communication
     if data.get('ipaddress'):
-        ip_comtype = CommunicationType.query.filter_by(comtype='IP').first()
+        ip_comtype = _ip_comtype()
         if ip_comtype:
             db.session.add(Communication(
                 assetid=asset.assetid,
@@ -596,7 +632,9 @@ def create_computer():
                 isprimary=True,
             ))
 
-    # Remote-access protocols
+    # Remote-access protocols. The return value is not recorded here: a create
+    # is already described in full by its 'created' entry, and there is no
+    # previous state to compare against.
     _sync_access_methods(comp, data)
 
     # Preserve legacy timestamps in import mode (no-op otherwise)
@@ -697,20 +735,27 @@ def update_computer(computer_id: int):
         ip = (data.get('ipaddress') or '').strip()
         primary = Communication.query.filter_by(
             assetid=asset.assetid, isprimary=True).first()
+        # Recorded, like every other field on this form. The address a PC
+        # answers on is how somebody finds it later; changing it wrote no audit
+        # entry at all, so a machine that moved had no history of moving.
+        oldip = primary.ipaddress if primary else None
+        if (oldip or None) != (ip or None):
+            changes['ipaddress'] = {'old': oldip, 'new': ip or None}
         if ip:
             if primary:
                 primary.ipaddress = ip
             else:
-                ip_comtype = CommunicationType.query.filter_by(comtype='IP').first()
-                if ip_comtype:
-                    db.session.add(Communication(
-                        assetid=asset.assetid, comtypeid=ip_comtype.comtypeid,
-                        ipaddress=ip, isprimary=True))
+                db.session.add(Communication(
+                    assetid=asset.assetid,
+                    comtypeid=_ip_comtype().comtypeid,
+                    ipaddress=ip, isprimary=True))
         elif primary:
             primary.ipaddress = None
 
     # Remote-access protocols
-    _sync_access_methods(comp, data)
+    accesschange = _sync_access_methods(comp, data)
+    if accesschange:
+        changes['accessmethods'] = accesschange
 
     # Audit log if there were changes
     if changes:
diff --git a/plugins/computers/frontend/views/BusinessPoliciesList.vue b/plugins/computers/frontend/views/BusinessPoliciesList.vue
index e2f3b971..db4d7a4e 100644
--- a/plugins/computers/frontend/views/BusinessPoliciesList.vue
+++ b/plugins/computers/frontend/views/BusinessPoliciesList.vue
@@ -2,7 +2,14 @@
   <div>
     <div class="page-header">
       <h2>Site Policies</h2>
-      <button class="btn btn-primary" @click="openModal()">+ Add Site Policy</button>
+      <button v-if="!featureOff" class="btn btn-primary" @click="openModal()">+ Add Site Policy</button>
+    </div>
+
+    <div v-if="featureOff" class="card feature-off-notice">
+      <strong>Site policies are not enabled on this site.</strong>
+      <p>Nothing can be created here until the feature is turned on.
+        The list below is empty because the feature is off, not
+        because nothing has been configured.</p>
     </div>
 
     <div class="card">
@@ -110,6 +117,7 @@ const toast = useToast()
 const policies = ref([])
 const configPolicies = ref([])
 const loading = ref(true)
+const featureOff = ref(false)
 
 const showModal = ref(false)
 const editing = ref(null)
@@ -135,6 +143,10 @@ async function loadData() {
     configPolicies.value = config.data.data || []
   } catch (err) {
     console.error('Error loading business policies:', err)
+    // The API answers 404 'Policy feature is not enabled' when the
+    // flag is off. Without this the page rendered its empty table
+    // and an Add button for a feature that cannot accept one.
+    featureOff.value = err?.response?.status === 404
   } finally {
     loading.value = false
   }
@@ -214,6 +226,13 @@ async function remove(p) {
 </script>
 
 <style scoped>
+.feature-off-notice {
+  border-left: 3px solid var(--warning);
+  margin-bottom: 1rem;
+}
+.feature-off-notice p {
+  margin: 0.4rem 0 0 0;
+}
 .item-row { display: flex; gap: 8px; align-items: center; margin-bottom: 6px; }
 .order-badge {
   display: inline-flex; align-items: center; justify-content: center;
diff --git a/plugins/computers/frontend/views/ConfigurationPoliciesList.vue b/plugins/computers/frontend/views/ConfigurationPoliciesList.vue
index 8e014be7..cbabc33d 100644
--- a/plugins/computers/frontend/views/ConfigurationPoliciesList.vue
+++ b/plugins/computers/frontend/views/ConfigurationPoliciesList.vue
@@ -2,7 +2,14 @@
   <div>
     <div class="page-header">
       <h2>Configuration Policies</h2>
-      <button class="btn btn-primary" @click="openModal()">+ Add Policy</button>
+      <button v-if="!featureOff" class="btn btn-primary" @click="openModal()">+ Add Policy</button>
+    </div>
+
+    <div v-if="featureOff" class="card feature-off-notice">
+      <strong>Configuration policies are not enabled on this site.</strong>
+      <p>Nothing can be created here until the feature is turned on. The
+        list is empty because the feature is off, not because nothing
+        has been configured.</p>
     </div>
 
     <div class="card">
@@ -123,6 +130,7 @@ const apps = ref([])
 const actionCatalog = ref([])
 const monitors = ref([])
 const loading = ref(true)
+const featureOff = ref(false)
 
 const showModal = ref(false)
 const editing = ref(null)
@@ -155,8 +163,13 @@ async function loadData() {
 
     if (pol.status === 'fulfilled') {
       policies.value = pol.value.data.data || []
+      featureOff.value = false
     } else {
-      failures.push('policies')
+      // The API answers 404 'Policy feature is not enabled' when the flag is
+      // off. Without telling them apart the page rendered an empty table and
+      // an Add button for a feature that cannot accept one.
+      featureOff.value = pol.reason?.response?.status === 404
+      if (!featureOff.value) failures.push('policies')
       console.error('Error loading policies:', pol.reason)
     }
 
@@ -284,6 +297,13 @@ async function remove(p) {
 </script>
 
 <style scoped>
+.feature-off-notice {
+  border-left: 3px solid var(--warning);
+  margin-bottom: 1rem;
+}
+.feature-off-notice p {
+  margin: 0.4rem 0 0 0;
+}
 .modal-lg {
   max-width: 760px;
 }
diff --git a/plugins/computers/frontend/views/PCsList.vue b/plugins/computers/frontend/views/PCsList.vue
index 51f2a1f5..18a2b14a 100644
--- a/plugins/computers/frontend/views/PCsList.vue
+++ b/plugins/computers/frontend/views/PCsList.vue
@@ -72,7 +72,15 @@
               </tr>
               <tr v-if="computers.length === 0">
                 <td colspan="8" style="text-align: center; color: var(--text-light);">
-                  No computers found
+                  <!-- A 403 is not an empty result. Rendering "No computers
+                       found" to somebody who simply may not see them tells
+                       them the fleet is empty, and they go looking for the
+                       data rather than for the permission. -->
+                  <template v-if="denied">
+                    You do not have permission to view computers. Ask an
+                    administrator for the computers.view permission.
+                  </template>
+                  <template v-else>No computers found</template>
                   <SearchSuggestion :suggestion="suggestion" @pick="applySuggestion" />
                 </td>
               </tr>
@@ -114,6 +122,8 @@ function applySuggestion(word) {
   loadComputers()
 }
 const showRetired = ref(false)
+// Told apart from an empty list: see the table's empty row.
+const denied = ref(false)
 const totalPages = ref(1)
 const perPage = ref(20)
 
@@ -140,6 +150,7 @@ async function loadComputers() {
     totalPages.value = response.data.meta?.pagination?.totalpages || response.data.meta?.pagination?.total_pages || 1
   } catch (error) {
     console.error('Error loading computers:', error)
+    denied.value = error?.response?.status === 403
   } finally {
     loading.value = false
   }
diff --git a/tests/test_plugins/test_computers_audit.py b/tests/test_plugins/test_computers_audit.py
new file mode 100644
index 00000000..55c397d2
--- /dev/null
+++ b/tests/test_plugins/test_computers_audit.py
@@ -0,0 +1,104 @@
+"""Changing how a PC is reached has to leave a record.
+
+Editing a computer wrote an audit entry for its named fields and nothing at all
+for two changes that matter most to anybody investigating later:
+
+  * the primary IP address - how the PC is found on the network
+  * the remote-access protocols and their ports - how somebody connects to it
+
+Both are set on the same form, in the same request, and both were invisible
+afterwards. A PC that moved address had no history of moving, and a PC that
+gained a VNC listener had no record of gaining one.
+"""
+import pytest
+
+from shopdb.api import db
+
+
+@pytest.fixture
+def pc(client, db, auth_headers):
+    from shopdb.core.models import AssetType, AssetStatus
+
+    if not AssetType.query.filter_by(assettype='computer').first():
+        db.session.add(AssetType(assettype='computer'))
+    if not AssetStatus.query.first():
+        db.session.add(AssetStatus(status='In Use'))
+    db.session.commit()
+
+    created = client.post('/api/computers', headers=auth_headers, json={
+        'assetnumber': 'AUDIT-PC-1',
+        'hostname': 'auditpc1',
+        'ipaddress': '10.20.30.40',
+    })
+    assert created.status_code == 201, created.get_json()
+    data = created.get_json()['data']
+    return data.get('computerid') or data['computer']['computerid']
+
+
+def _entries(entityid):
+    from shopdb.core.models import AuditLog
+
+    return (AuditLog.query
+            .filter_by(entitytype='Computer', entityid=entityid)
+            .order_by(AuditLog.auditlogid.desc()).all())
+
+
+def test_moving_a_pc_to_another_address_is_recorded(client, auth_headers, pc):
+    response = client.put('/api/computers/%d' % pc, headers=auth_headers,
+                          json={'ipaddress': '10.20.30.99'})
+    assert response.status_code == 200, response.get_json()
+
+    latest = _entries(pc)[0]
+    assert 'ipaddress' in (latest.changes or {}), latest.changes
+    assert latest.changes['ipaddress']['old'] == '10.20.30.40'
+    assert latest.changes['ipaddress']['new'] == '10.20.30.99'
+
+
+def test_an_unchanged_address_records_nothing(client, auth_headers, pc):
+    """A PUT that re-sends the same value is not a change, and an audit log
+    full of non-events is one nobody reads."""
+    before = len(_entries(pc))
+    response = client.put('/api/computers/%d' % pc, headers=auth_headers,
+                          json={'ipaddress': '10.20.30.40'})
+    assert response.status_code == 200
+    assert len(_entries(pc)) == before
+
+
+def test_changing_the_remote_access_protocols_is_recorded(client, db,
+                                                          auth_headers, pc):
+    from plugins.computers.models import AccessProtocol
+
+    rdp = AccessProtocol(name='RDP', scheme='rdp', linktemplate='rdp://{host}')
+    vnc = AccessProtocol(name='VNC', scheme='vnc', linktemplate='vnc://{host}')
+    db.session.add_all([rdp, vnc])
+    db.session.commit()
+
+    client.put('/api/computers/%d' % pc, headers=auth_headers,
+               json={'accessmethods': [{'protocolid': rdp.protocolid}]})
+    response = client.put('/api/computers/%d' % pc, headers=auth_headers,
+                          json={'accessmethods': [
+                              {'protocolid': vnc.protocolid,
+                               'portoverride': 5999}]})
+    assert response.status_code == 200, response.get_json()
+
+    latest = _entries(pc)[0]
+    assert 'accessmethods' in (latest.changes or {}), latest.changes
+    change = latest.changes['accessmethods']
+    assert change['old'] == ['%d:default' % rdp.protocolid]
+    assert change['new'] == ['%d:5999' % vnc.protocolid]
+
+
+def test_resending_the_same_protocols_records_nothing(client, db,
+                                                      auth_headers, pc):
+    from plugins.computers.models import AccessProtocol
+
+    ssh = AccessProtocol(name='SSH', scheme='ssh', linktemplate='ssh://{host}')
+    db.session.add(ssh)
+    db.session.commit()
+
+    client.put('/api/computers/%d' % pc, headers=auth_headers,
+               json={'accessmethods': [{'protocolid': ssh.protocolid}]})
+    before = len(_entries(pc))
+    client.put('/api/computers/%d' % pc, headers=auth_headers,
+               json={'accessmethods': [{'protocolid': ssh.protocolid}]})
+    assert len(_entries(pc)) == before