Authorisation is a single decision point consulted by every service, not logic repeated per service.
Denials are audited as carefully as permissions. An audit trail that records only what succeeded cannot answer the question an investigation actually asks.
The prior value is retained on every write, so any classification can be explained months later without a restore.
Audit properties
Append-only, 7-year retention, held in a separate store with its own credentials and object-lock retention.
Every record carries actor, action, entity URN, before, after and correlation id.
Quarterly access review over the audit index; the review itself is audited.
Assumption
Immutability is enforced by storage-level object lock and separated credentials rather than by a ledger database. Confirm that this satisfies the internal audit standard before build.
