Write an audit event for every sensitive action

How to do it

The list covers sign-ins, failed sign-ins, two-factor changes, role changes and admin actions. It also covers data exports, deletions, API keys, payout details and security settings. Reading a person's data is covered in the access logging rule. Money movements have their own money audit log and payment ledger. Mark whether the actor is a person, a service or an AI agent. Use UTC times and the request ID. Record "from where" as a shortened IP address or a place, as keep only what you need asks. Store IDs, never the data itself. ISO/IEC 27001:2022 control A.8.15 and SOC 2 criterion CC7.2 both expect this log.

Example

export function auditEvent({ actor, actorType, action, target, requestId, sourceIp, outcome }) {
  return {
    at: new Date().toISOString(),
    actor, actor_type: actorType,
    action, target,
    request_id: requestId, source_ip: sourceIp,
    outcome,
  };
}
await auditLog.append(auditEvent({ actor: 'u_381', actorType: 'person', action: 'role.grant', target: 'u_902:admin', requestId, sourceIp, outcome: 'success' }));

from datetime import datetime, timezone

def audit_event(*, actor, actor_type, action, target, request_id, source_ip, outcome) -> dict:
    return {
        "at": datetime.now(timezone.utc).isoformat(),
        "actor": actor, "actor_type": actor_type,
        "action": action, "target": target,
        "request_id": request_id, "source_ip": source_ip,
        "outcome": outcome,
    }

audit_log.append(audit_event(actor="u_381", actor_type="person", action="role.grant",
                             target="u_902:admin", request_id=request_id, source_ip=source_ip, outcome="success"))

How to check

An end-to-end test performs every action on the list. For each, the audit store holds exactly one event with every field filled.