Audit Log Service · View 11 of 40 · 3 · Structure
Decisions
- Immutability is a locked time-based retention policy on the container. Once locked, the policy may be extended and cannot be shortened, deleted or bypassed — not by the subscription owner, not through a support request, and not by the plane that wrote the object.
- Segments are grouped by tenant, then date, then event class. That partitioning is a retention and residency boundary first and a query optimisation second.
- Compaction of small segments is permitted only in a form that preserves the original record bytes and carries the original segment roots forward as leaves. A compaction that cannot be verified is a deletion with extra steps.
Numbers
- A segment closes at 60 s or 256 MB, whichever comes first. At 25 k/s the size bound wins for the largest tenant and the time bound wins for the long tail.
- Checkpoints are signed every 15 minutes over every tenant head; the RFC 3161 countersignature adds an external clock the service cannot move.
- Records are capped at 256 KB and rejected above it rather than truncated.
Assumptions
- Azure Blob version-level immutability plus a locked container policy is treated as equivalent in force to S3 Object Lock in compliance mode. This is the single most load-bearing platform assumption in the set and should be confirmed with Microsoft in writing before build.
