Audit Trail
Immutable, chronological record of every authorization decision — who, what, when, scope, resource, action, and outcome. Enables compliance reporting and incident investigation.
An audit trail is an immutable, chronological record of every authorization decision — who made the request, what action was attempted, on what resource, in which scope, at what time, and whether it was allowed or denied. It is the evidence layer for compliance, investigation, and access governance.
What a good audit trail contains
- Subject identity: who made the request (user, service, API key)
- Scope/tenant: which workspace was the request in
- Resource + action: what was attempted
- Decision: allowed or denied, with reasoning (which roles/permissions matched)
- Timestamp: when the decision was made
- Source IP / context: where the request originated
Non-repudiation
A cryptographic audit trail ensures non-repudiation — decisions cannot be denied after the fact because every entry is signed and independently verifiable without trusting the authorization service.
Related terms
Security control that prevents a single user from performing conflicting operations. For example, the same person cannot both create and approve a payment — requires two distinct identities.
Signed, verifiable proof tokens produced for every authorization decision. Non-repudiable audit trail that can be verified without trusting the authorization service.
Property of an authorization system where decisions cannot be denied after the fact. Cryptographic receipts provide verifiable proof that a specific decision was made at a specific time.