AUDIT EVENT DESIGN REVIEW
Status: proposed, unexecuted
Question: who changed a member role and did the change commit?
Fields: use fields.csv and fictional role-change.json. Remove each field and record which question becomes unanswerable.
Exclude request bodies, authorization headers, access tokens, passwords and unrelated profile values.
Trust: resolve actor and tenant on server; do not accept caller-provided identity as audit authority.
Commit: required role-change audit intent and business mutation commit together; no completed-change event for rollback.
Delivery: event_id deduplicates delivery; occurred_at differs from observed_at. Order scope must be explicit.
Access: writer append permission separated from history mutation; reader server-enforces tenant/role scope.
Evidence: test collector delay, failed transaction, cross-tenant read and privileged retention change separately.
Integrity: identify actor being defended against and protected verification reference, rather than relying on append-only/tamper-proof labels.
Retention: named owner approves policy and configuration changes; no universal duration proposed.
Acceptance: compare permitted committed change with failed transaction through the actual tenant-scoped reader.