Audit evidence
Traceable evidence for every privileged action
This page models what an auditor would be shown: a tamper-evident trail of privileged operations, the policy decisions behind denials, and the evidence packs that back each control. The events below are fabricated — there is no live audit sink behind this application.
6
3
7
Audit trail
Fabricated events| Event | Timestamp (UTC) | Actor | Action | Object | Outcome | Evidence |
|---|---|---|---|---|---|---|
| AU-1041 | 2026-08-13 03:12:04 | svc_etl_loader | MERGE into DIM_CUSTOMER | DIM_CUSTOMER | allowed | run/2026-08-13/customer-master#stage-3 |
| AU-1042 | 2026-08-13 03:14:51 | analyst_role | SELECT on restricted column TAX_ID_TOKEN | DIM_CUSTOMER | denied | policy/column-masking#restricted |
| AU-1043 | 2026-08-13 02:58:22 | dba_oncall | ALTER TABLE ... EXCHANGE PARTITION | FCT_BILLING_LEDGER | allowed | change/CHG-2291 |
| AU-1044 | 2026-08-12 23:41:07 | svc_purge_agent | DELETE beyond retention horizon | ARC_LEDGER_HISTORY | flagged | retention/proof-of-purge#2026-08-12 |
| AU-1045 | 2026-08-12 19:02:33 | unknown_client | Login attempt from unlisted network | OLTPPRD | denied | access/denied-network#7741 |
| AU-1046 | 2026-08-12 14:22:10 | release_pipeline | Deploy PL/SQL package PKG_LEDGER_LOAD v4.2 | PKG_LEDGER_LOAD | allowed | change/CHG-2288 |
Evidence packs
Every schema or PL/SQL change carries a change reference, a reviewer and a rollback note. Deployment is pipeline-driven so the artefact hash is recorded alongside the change.
Grants are made to roles, never to people. Denied attempts are retained with the policy that produced the denial so recertification reviewers can see intent as well as outcome.
Purge operations require a checksum manifest of the rows being removed. The manifest is written to a write-once sink before the delete commits.
Each restore rehearsal produces a drill record: timestamp, scope, measured RTO, reconciliation result and any follow-up actions raised.