Audit Log Service  ·  View 31 of 40  ·  6 · Operations

Shipping the Service, Changing the Rules

Six stages, one of which enforces the whole architecture's central principle in CI rather than in code review.

Editable source SVG draw.io All views
Source GitHub Repository service + IaC + policy Schema Pull Request vocabulary review Build Container Build reproducible SBOM + Signature Syft · Cosign Property Tests chain invariants Gate No-Delete-Verb Check custody data layer Schema Compatibility backward only Retention Lock Scan IaC policy Approve Multi-Party Approval retention · keys · access Entra PIM time-boxed elevation Approval Is a Record each approver Deploy Argo CD one app per plane Blue / Green Ingest no dropped ack Canary Custody one shard first Verify Synthetic Probe ingest → seal → verify Automatic Rollback on chain conformance revert revision Shipping the Service, and Changing the Rules It Enforces External / third party Application we own Security / platform Decision point Opportunity failure / alternate The no-delete-verb gate is a static check over the custody plane's data-access layer: any UPDATE, DELETE or blob-delete call reaching that package fails the build. Principle 1 of this architecture is enforced by CI, not by a code-review convention. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • The no-delete-verb gate is a static check over the custody plane's data-access package: any UPDATE, DELETE or blob-delete call reaching it fails the build. Principle 1 is enforced by a pipeline, not by a convention.
  • Changes to retention policy, disposal schedules, key rotation and access policy require multi-party approval, and each approval is recorded as an audit event in this log before the change is applied.
  • Schema changes are backward-compatible only. A record written under v3 must remain readable and verifiable under v7 for the whole of its ten-year retention.

Deployment

  • Argo CD with one application per plane, so a custody rollout cannot be bundled with an ingest rollout.
  • Blue/green on ingest so no acknowledgement is dropped mid-deploy; canary on custody, one chain shard first.
  • A synthetic probe writes, seals and verifies a test record continuously in production. Failure of the chain-conformance step rolls the revision back automatically.

Risks

  • A pipeline that can deploy the custody plane is, in effect, a principal that can change custody behaviour. It is treated as one: the deploying identity is PIM-gated, its use is an audit event, and the manifest it deployed is recorded with the release.
◀  Two Regions, and Custody That Belongs to Neither All views Observability  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source31-cicd-and-change-control