Audit Log Service  ·  View 27 of 40  ·  5 · Runtime

When the Audit Plane Is Unavailable

The second core question answered per event class, with what an auditor sees afterwards in the bottom lane.

Editable source SVG draw.io All views
Declare Emit normally Audit plane down Spool exhausted Recover Critical class — role.grant · key.use · policy.change · record.export fail_mode = closed Synchronous ack required Retry 3× with backoff Business action refused No gap to explain Standard class — record.read · session.start · config.view fail_mode = open Async, receipt later Spool locally ≥ 1 h Gap marker emitted Replay, original occurred_at What the service does Class fixed in the registry Dedup on idempotency key Buffer holds 72 h Counts dropped, per tenant Flags skew beyond 5 min What an auditor later sees Policy, per class, dated The gap marker is a record Late arrival is visible When the Audit Plane Is Unavailable — Declared per Event Class Question 2 answered. Fail-open everywhere buys availability and quietly sells the record; fail-closed everywhere makes this service a first-order dependency of 410 others at a 99.99% target its callers do not themselves meet. The class declares it, the producer cannot change it at runtime, and the gap marker means an open failure is still an event rather than a silence. v 1.0 · owner Data & AI Global Practice · date 2026-09

Question 2 answered

  • Per event class, declared in the schema registry, enforced here, and not changeable by the producer at runtime.
  • Fail-closed everywhere would make this service a first-order availability dependency of 410 others, at a 99.99% target most of its callers do not themselves meet. Fail-open everywhere buys availability and quietly sells the record.
  • A privilege grant fails closed and refuses the business action. A document view fails open and emits a gap marker — which is itself an audit record, so an open failure is a visible event rather than a silence.

What the producer must do

  • Spool locally for at least one hour and replay with the original occurred_at.
  • Retry with backoff and an idempotency key, so a retry after a timeout does not become a second record.
  • Declare the class at onboarding. The engineer finds out whether their action fails open or closed before it ships, not during the incident.

Risks

  • The fail-closed set has to stay small. Every class added to it converts an availability problem here into an availability problem in 410 other services, and the review that adds one should treat it as a change to those services' SLOs.
◀  Legal Hold All views Losing the Index  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source27-fail-open-or-closed