Audit Log

An audit log records events relevant to accountability, such as who requested an operation, which resource was involved, whether access was allowed, and when it happened. It supports investigation rather than replacing the control itself.

A request and its outcome are different events

An entry saying refund requested does not prove that the refund completed. Correlate the authorization decision with the operation's observed outcome. Preserve useful identifiers and timestamps, and define what missing or failed logging means for the service.

A detailed record is not automatically a truthful one. Its value depends on collection coverage, time information, and protection against unauthorized alteration.

When who-did-what is not enough

Access records answer questions about people. Other common jobs ask something else of the same log, and an access-shaped entry cannot answer them.

Reproducing a figure that was already published. Someone asks why last quarter’s reported revenue differs from the same query run today. Knowing who opened the report is useless here; what is needed is what the number was computed from. That means recording, with the approved output, the versions of the inputs, the definition or metric version in force, the code or query revision, and the run that produced it. Without those references the log establishes that a report existed and nothing about why it said what it said.

Keeping a manual decision. In master data work someone judges that two customer records are the same, or that a previous merge was wrong and must be split. The entry that makes this usable names the source system and source identifier on each side, the master identifier the decision produced, who decided and why, when it took effect, and which earlier decision it supersedes. A log that says only records merged cannot be reviewed, reversed, or explained to the person whose data it was.

Recording a decision and re-applying it are different requirements. A rebuild can lose human judgments unless the pipeline reads them as inputs and applies them to the appropriate records and versions. A table, event log, versioned file, or API can provide that input. What matters is durable, machine-readable decisions with stable identifiers and rules for superseded decisions, not a particular storage format. Test the contract by rebuilding and checking that the applicable decisions remain in effect.

The evidence can become another sensitive copy

Logging a full customer message may recreate information the main system has deleted. Prefer sufficient metadata over unnecessary payloads, restrict log access, and apply retention rules. Authorized investigators may need selected detail, but that need should be explicit. Test that both allowed and denied paths produce the intended evidence.

References

• OWASP Authorization