Audit Log Service · View 15 of 40 · 4 · Data
Decisions
- tenant_id and received_at are service-assigned and unforgeable. actor is recorded as the service observed it, independently of any identity the payload claims — and both are kept, because a producer lying about itself is exactly the event worth having.
- occurred_at is stored precisely as asserted and is never corrected. Where it diverges from received_at by more than five minutes, clock_divergence_s records the fact beside it. The service does not rewrite a producer's claim; it contradicts it.
- denied and error outcomes carry the same schema and the same rigour as success. A refused privileged action is usually the more interesting record.
Question 6 answered
- The log claims ordering by commit, over the service's own clock, per partition and per tenant chain. It claims nothing about the order in which actions occurred in the world.
- occurred_at is indexed and queryable so an investigator can order by occurrence; the chain is not built on it, because a spooled event can arrive hours late and a hostile producer can assert anything.
- The external RFC 3161 countersignature on each checkpoint is what stops the service backdating its own clock.
Constraints
- 256 KB hard cap per record, rejected rather than truncated.
- Secrets, credentials and full payment instruments are prohibited and enforced by a pre-commit detector, with the verdict itself recorded on the payload.
