Audit Log

An audit log records events relevant to accountability, such as who requested an operation, which resource was involved, whether access was allowed, and when it happened. It supports investigation rather than replacing the control itself.

A request and its outcome are different events

An entry saying refund requested does not prove that the refund completed. Correlate the authorization decision with the operation's observed outcome. Preserve useful identifiers and timestamps, and define what missing or failed logging means for the service.

A detailed record is not automatically a truthful one. Its value depends on collection coverage, time information, and protection against unauthorized alteration.

The evidence can become another sensitive copy

Logging a full customer message may recreate information the main system has deleted. Prefer sufficient metadata over unnecessary payloads, restrict log access, and apply retention rules. Authorized investigators may need selected detail, but that need should be explicit. Test that both allowed and denied paths produce the intended evidence.

Reference: OWASP Authorization.