Audit Log Service

Who writes to the audit log, who reads it, who checks it — and which custody is deliberately held by somebody else.

Seven stages from a producer's call to a proof an outsider can check — and the one feedback edge that surprises people.

The critical design decision drawn as a boundary: which plane may create a record, which may retain and expire one, and which may only prove things about them.

Fourteen actors in four groups, each with the goal they actually arrive with — including the four that are machines.

The investigator's path from an alert to a defensible timeline, and the moment where the tool stops being trustworthy to them.

The only journey in the set whose best moment happens offline, on a machine this organisation does not run.

The producer's path, and the phase where an architecture question is wearing a UX costume.

What depends on what, and the two sideways arrows that are the log auditing its own use.

Every deployable unit, its technology and its scale, grouped by the plane whose identity it runs under.

Every check that happens before an event can be accepted — and the absence of any path that changes one.

Assemble, chain, lock, expire — the four things that happen to a record after nobody can change it any more.

Every way in and every way out, with protocol and direction — and no interface that is both.

Four levels from a record's bytes to a signed global checkpoint — the answer to the first core question in the requirement.

Four tiers with four different durability contracts, ordered by what losing each one actually costs.

One canonical, versioned schema — and the small number of fields the producer is not allowed to influence.

The entities that make a range provable, including the one that lets a disposed range still verify.

What happens to one record between the acknowledgement and the moment somebody can find it, with the volumes at each hop.

What each store does at each age — and the one property that does not change as things get cheaper.

The answer to the seventh core question, given as a split rather than a principle.

Thirteen messages from a producer's call to a durable commit — and a precise statement of what message 11 promises.

One fifteen-minute checkpoint end to end, including what happens when the key service is unreachable.

Eleven messages, and the one that is deliberately ordered before the query runs rather than after.

Six stages from a request to a verdict — and why the verdict is never a boolean.

Twelve messages, the last two of which involve nothing this organisation runs.

Seven steps that close a loop, and the answer to the fifth core question given as a sequence rather than a choice.

How disposal is suspended indefinitely without anybody touching, moving or hiding a record.

The second core question answered per event class, with what an auditor sees afterwards in the bottom lane.

Six stages proving the claim the whole set rests on — that deleting the index loses no record.

What runs where, what is zone-redundant by construction, and which subscription deliberately is not ours.

Active-passive failover, one-way replication, and the reason the checkpoint ledger sits outside both regions.

Six stages, one of which enforces the whole architecture's central principle in CI rather than in code review.

Signal type by pipeline stage, and the deliberate emptiness of the monitoring stack.

Where the money actually goes, and an honest statement that the stated target is not reachable.

Running a system you are structurally forbidden from reading, and the order in which it is allowed to degrade.

Six zones of decreasing exposure, every crossing authenticated — and the one edge that deliberately is not.

How a workload proves who it is, and why the service records the identity it observed rather than the one it was told.

Eight roles against seven capabilities, where the blanks are the design.

Three kinds of key, what the outside world is given, and the combinations nobody holds.

Six attempts by six privileged insiders, and what each one actually meets — including the row where the residual risk is real.

Sixteen failures in four categories, sorted by what the service is permitted to do about each.