Skip to content

ADR 0014: Append-Only Security Audit Events

Decision

BooksPlus should maintain append-only audit events for security-relevant and accounting-relevant actions.

Security audit and accounting audit should be aligned. The system should be able to explain who performed a sensitive action, when it happened, from what machine or context, and what object or period was affected.

Rationale

BooksPlus is intended to preserve information, support review, reduce avoidable accounting risk, and provide audit-ready behavior. Security events are part of that same control model.

The audit log should not be treated as a troubleshooting afterthought. It is part of the accounting control system.

Examples of events

BooksPlus should consider audit events for:

  • application open or unlock;
  • failed step-up confirmation;
  • user created, disabled, or retired;
  • role or permission changed;
  • accounting policy changed;
  • journal entry posted or reversed;
  • fiscal period closed or reopened;
  • source document attached or superseded;
  • backup created, exported, or restored;
  • company data exported;
  • support access granted, used, or revoked;
  • license activated, transferred, or disabled.

Implications

Audit events should be append-only from the application's perspective.

Normal users should not be able to edit or delete audit events. Authorized users may view, filter, export, or archive audit information according to policy.

Guidance

For MVP:

  • create a standard audit event shape;
  • require actor, timestamp, action, target, and result;
  • record reason/comment for dangerous actions;
  • keep audit events readable by reviewers;
  • do not allow ordinary application flows to alter past audit events.