Audit Log Service  ·  View 08 of 40  ·  3 · Structure

Layered Architecture

What depends on what, and the two sideways arrows that are the log auditing its own use.

Editable source SVG draw.io All views
Access and evidence Query Console scoped, justified Export Service watermarked Proof Service inclusion, absence Offline Verifier published binary Receipt API commit, seal Service Ingest API write only Query API read only Verification Service range and rolling Retention Engine extend only Disposal Service certificate signed Processing Validator JSON Schema Secret Detector pre-commit Sealer Parquet · zstd Chain Service Merkle Indexer at-least-once Reconciler segment vs index Data Kafka Buffer 72 h Segment Store Blob WORM Checkpoint Ledger append only ClickHouse Index derived Segment Registry PostgreSQL Dedup Cache Valkey · 24 h Platform AKS 3 zones Microsoft Entra ID workload identity Managed HSM FIPS 140-3 L3 OPA authorization Prometheus + Loki no record content Argo CD GitOps read is a record certificate is a record Layered Architecture — Dependencies Point One Way Application we own External / third party Queue / topic Data store Security / platform event / async The two lateral arrows are the log auditing its own use; key use in the HSM re-enters the same way. Nothing points up: a layer calls only downwards, and the data layer calls nothing at all. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • Dependencies point downwards only. The two lateral arrows are deliberate: the query plane and the disposal service both write records through the ingest plane like any other producer, using their own workload identities.
  • That creates a real cycle — reading depends on writing. Resolved by buffering read records locally for up to 60 s and failing the read closed beyond that: a query that cannot be recorded does not run.
  • The data layer calls nothing. Every store is written by the layer above it and read by nothing beneath it.

Technology per layer

  • Service and processing: Rust for the ingest hot path, Go everywhere else. Both chosen for predictable tail latency rather than throughput.
  • Data: Kafka, Blob, Confidential Ledger, ClickHouse, PostgreSQL, Valkey — five stores with five different durability contracts, set out in view 14.
  • Platform: AKS across three zones, Entra ID, Managed HSM, OPA, Prometheus and Loki, Argo CD.

Omitted here

  • Replica counts and node sizes are on view 09; zone placement is on view 29.
◀  Journey — Emit Without Inheriting Our Outage All views Container Architecture (C4 L2)  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source08-layered-architecture