Auditability
The ability to reconstruct who did what, to which resource, when, and from where — reliably enough to be relied upon after the fact.
An audit log is not an application log. It has different requirements: it must be tamper-evident (append-only, ideally written to a store the application cannot modify or delete), complete for the defined set of significant actions, attributed to a real principal rather than to a shared service account, and retained for the period regulation requires.
The architectural obligations that follow are easy to miss. Identity must be propagated through service hops, or every downstream action is attributed to "the API gateway". Asynchronous processing must carry the originating principal into the queue, or the audit trail breaks at the first async boundary. And access to the audit store itself must be separately controlled and itself audited.
Decide the significant-action list explicitly — authentication events, authorisation denials, permission changes, data exports, administrative actions, and access to sensitive records. Logging everything is how audit trails become unusable.