Audit Log Service · View 22 of 40 · 5 · Runtime
Decisions
- The read record is written before execution. A query that times out, is cancelled, or returns nothing is still on the record — writing it afterwards would make the interesting case the one that leaves no trace.
- The read record carries the query text, the caller, the justification reference and, once known, the result count and whether the set was truncated.
- Results state their completeness bound: the sealed segment the answer is complete to. A truncated result set says so explicitly rather than silently capping.
Cost and scope control
- OPA returns a budget with the authorization: a wall-clock limit and a row cap per role. An unbounded 13-month scan is the cost incident this service would otherwise have.
- Tenant partition pruning happens before any scan, so query cost is proportional to time range and predicate selectivity rather than to corpus size.
- Payload bytes are fetched from segments for the page being read only, and decrypted under that tenant's key.
Risks
- Reading cannot be undone. Detection names the reader and the volume; it does not put the data back. Anomalous read patterns are alerted (view 32) and export volume is capped per role (view 24), which is mitigation rather than prevention.
