Contract: Security audit events

Status

Draft.

Purpose

This contract defines the minimum structure and behavior for security-relevant audit events.

Contract

Security-relevant actions must produce durable audit events.

Audit events must be append-only from normal application flows.

Required fields

A security audit event should include:

• event identifier;
• event timestamp;
• actor identifier;
• company identifier when the action is company-scoped;
• action name;
• target type;
• target identifier when applicable;
• result;
• reason/comment when applicable;
• machine or installation identifier when available;
• correlation identifier when part of a larger workflow.

Rules

• Audit events must not be edited through ordinary application behavior.
• Audit events must preserve historical actor identity.
• Failed authorization or failed step-up confirmation may be logged when relevant.
• Sensitive exports, backup restores, user changes, and permission changes must be logged.
• Audit events should be readable by authorized reviewers.
• Protected action audit events must use the same action names as the protected action registry.
• Company-scoped audit events must use company identity as defined by the Company Identity and Context contract.
• Development and test actors must produce ordinary audit events when they perform protected actions.

Acceptance criteria

• Creating a user emits an audit event.
• Changing permissions emits an audit event.
• Closing or reopening a period emits an audit event.
• Exporting company data emits an audit event.
• Restoring a backup emits an audit event.
• A developer test actor performing a protected action emits an audit event with actor, company, action, result, and correlation context when available.