Audit Logging
What we record for every access decision, including the denials, and how long it is kept.
Every access decision is recorded — including the denials. Denials matter more than grants for investigation: a pattern of denied access is the signal that somebody is probing.
| Recorded | Why |
|---|---|
| Timestamp, tenant, user | Who asked, and under which tenant boundary |
| Document identifier | What was considered, whether or not it was shown |
| Allowed or denied | The decision itself |
| Reason | Which rule decided it — stale list, explicit deny, no grant |
| Source system | Which connector supplied the permission |
The log is append-only and is itself tenant-isolated. Retention is set per engagement in the data processing agreement rather than by a blanket default, because the right answer differs between a bank and a startup.