Audit and investigation

Audit records explain administrative changes and runtime decisions. Use them to connect a caller, target, policy version, credential mode, and outcome for a specific time window.

Start with a bounded question

Identify the approximate request time, environment, actor or agent, and target tool. Search that window before broadening it. A correlation identifier can connect records without copying the request payload into a ticket.

Read the decision before changing configuration

A denial can come from identity, policy, credentials, routing, session state, or runtime readiness. The event’s reason identifies the failing boundary. A general HTTP status alone is often insufficient.

For a configuration investigation, compare the decision’s policy or projection version with the replica’s accepted configuration. A newer console value is not evidence that the request used it.

Keep evidence minimal

Audit should retain decision metadata. Raw arguments, upstream responses, bearer tokens, and secret material do not belong in routine evidence. Payload logging is a separate, explicitly controlled concern with redaction requirements.

An enabled export configuration is not proof that an external SIEM received an event. Verify receipt at the destination when external delivery is part of the acceptance criteria.

Continue with searching audit and the audit event reference.

Implementation reference

Read the source contract.