Audit Log Service  ·  View 03 of 40  ·  1 · Context and scope

Four Planes and the Rule Between Them

The critical design decision drawn as a boundary: which plane may create a record, which may retain and expire one, and which may only prove things about them.

Editable source SVG draw.io All views
Capture plane — may create a record, may never remove one Boundary Ingest API write only Validator schema + secrets Hand-off Durable Buffer no delete verb Quarantine rejections, audited Custody plane — may retain and expire, may never create a record Seal and chain Sealer append only Chain Service hash forward Segment Store locked retention Expire Retention Engine extend, never shorten Legal Hold Registry legal role only Disposal Service certificate or nothing Query plane — derived, authoritative for nothing Projection Indexer rebuildable Search Index disposable Access Query API tenant scoped Archive Query async jobs Evidence plane — may read and prove, may never write a record Proof Verifier recompute chain Proof Service inclusion, absence Delivery Export Service watermark, cap Offline Verifier no service needed Managed HSM key custody team Confidential Ledger checkpoint custody Microsoft Entra ID identity team sealed hand-off projection signed head sign, never export Four Planes — No Principal Can Both Write and Remove Application we own Queue / topic Data store External / third party Security / platform event / async synchronous Four planes, four managed identities, four Entra groups, no membership overlap. The capture plane holds no delete verb in its data-access layer; the custody plane holds no insert verb for records. v 1.0 · owner Data & AI Global Practice · date 2026-09

The decision

  • The write path holds no authority over the record's lifetime. Capture, custody, query and evidence are four planes with disjoint credentials, and only custody — which cannot create records — can express retention.
  • This is enforced structurally, not by policy: the capture plane's data-access layer contains no update or delete verb, and the custody plane contains no insert verb for records. A CI gate fails the build if either appears (view 31).
  • The alternative — one service that ingests, stores, indexes and expires under a single identity — is dramatically simpler and is what most audit logging becomes. It is also worth nothing as evidence, because the party holding the record could always have changed it.

How the separation is real

  • Four AKS namespaces, four managed identities, four Entra groups with no shared membership and no group nesting between them.
  • Blob data-plane roles granted per plane: the sealer holds create-only on the segment container; the verifier holds read-only; nothing anywhere holds Storage Blob Data Owner.
  • Immutability is a property of the storage, not of the application. Access control can be misconfigured; a locked retention policy cannot be talked out of it.

Risks

  • A shared platform team with cluster-admin on AKS could in principle impersonate several plane identities. Mitigated by workload identity federation bound to service accounts, PIM-gated cluster-admin and alerting on any use of it — not eliminated.
  • The separation costs latency and operational surface. It is the price of the negative claim the service exists to make.
◀  High-Level Architecture All views Actors and Their Core Journeys  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source03-three-planes