Audit Log Service  ·  View 07 of 40  ·  2 · People and journeys

Journey — Emit Without Inheriting Our Outage

The producer's path, and the phase where an architecture question is wearing a UX costume.

Editable source SVG draw.io All views
Producer Engineer One of 410 owning teams Goal — Emit audit events for a new privileged action without taking on a new availability dependency Trigger — A role-grant screen ships next sprint and legal has classed it as auditable Done when — Events land, and I can prove afterwards which ones were sealed 1 · Model the event class 2 · Onboard identity 3 · Emit ◆ moment of truth 4 · Outage ◆ moment of truth 5 · Reconcile prove it landed What they do Picks an action verb Declares the class Federates identity POST /v1/events Spools locally Checks receipts Where they do it Schema registry Entra federation Ingest SDK Local spool Receipt API Behind the glass Apicurio + review No shared secret Dedup + quota 72 h buffer Seal receipt How it feels Confident Working Blocked Where it hurts Verb must be agreed Open or closed? Was it really sealed? What answers it Vocabulary PR, 1 day Short-lived tokens p99 150 ms Declared per class Seal receipt API Producer Engineer — Emit Without Inheriting Our Outage The trough is the outage, and it is a design question rather than a UX one: the producer must know before it ships whether this class fails open with a gap marker or fails closed and stops the business action. View 27 makes that a declaration, not a default. v 1.0 · owner Data & AI Global Practice · date 2026-09

The trough, and its answer

  • The low point is Outage, and the pain chip says it exactly: open or closed? The engineer must know before shipping whether an audit-plane failure blocks the business action or lets it through with a gap.
  • Answered by making it a declaration rather than a default. Each event class carries fail_mode in the schema registry, the producer cannot change it at runtime, and an open failure emits a gap marker that is itself an audit record. View 27.
  • Last pain: 'was it really sealed?'. Answered by a two-stage receipt — a commit receipt at acknowledgement, a seal receipt queryable once the object is locked.

Onboarding cost

  • A new action verb is a pull request against the controlled vocabulary, reviewed by compliance, typically one working day.
  • Identity is workload identity federation, so there is no secret to store, rotate or leak on the ingest path.
  • The SDK's local spool holds at least one hour and replays with the original occurred_at, never with the replay time.

Assumptions

  • 410 producing services, one SDK in four languages. Producers that cannot take the SDK use the stream path and lose the synchronous receipt, which is stated at onboarding rather than discovered later.
◀  Journey — Verify Without Trusting the Operator All views Layered Architecture  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source07-journey-producer-engineer