Audit Logging
What we record for every access decision, including the denials, and how long it is kept.
Every access decision is recorded, including the denials. Denials matter more than grants for investigation: a pattern of denied access is the signal that somebody is probing.
| Recorded | Why |
|---|---|
| Timestamp, tenant, user | Who asked, and under which tenant boundary |
| Document identifier | What was considered, whether or not it was shown |
| Allowed or denied | The decision itself |
| Reason | Which rule decided it: stale list, explicit deny, no grant |
| Source system | Which connector supplied the permission |
The log is append-only and is itself tenant-isolated. Retention is set per engagement in the data processing agreement rather than by a blanket default, because the right answer differs between a bank and a startup.