Context
Models can opt in to auditing (0046), the AI engine writes audit events (0021), and operator endpoints must be audited (0051). An audit trail written by each service into its own database cannot be queried or retained as one, and a trail written inside the same transaction as the change couples every service to it. Cross-service communication is by published events (0014 decision 4).Decision
- A single audit service owns the audit store. No other service reads or writes its tables.
- Services publish audit events; the audit service consumes them. A service never calls the audit store directly.
- An audit event carries actor, tenant, action, target type and id, time, and request id. It never carries secret values or PII field contents; changed-field names only.
- Delivery is at-least-once and consumption is idempotent, keyed by event id.
- The audit store is append-only to its consumers. Retention period: TODO.
- Tenants can read their own audit events; operators can read across tenants through an audited endpoint.
Consequences
- One place to answer “who did what”, needed for the SOC 2 target.
- An audit event can lag its change; it is not a synchronous guard.
- Reliable publication depends on the outbox pattern, which is a separate decision.