app.audit_events
TablePartitioned by monthRow level security on
Append-only compliance ledger (Section 7.3, Section 8.4): who did what to which row, with a diff. Kept 7 years in monthly partitions; personal data in plaintext is redacted at 90 days at every JSON depth (invariant 23).
Primary key: id, created_at
| Column | Type | Nullable | Description |
|---|---|---|---|
| id | uuid | No | Audit event id, UUID v7. |
| org_id | uuid | No | Owning org. A row never moves to another org.References app.organizations.id |
| actor_kind | app.actor_kind | No | Person, Service or System. |
| actor_person_id | uuid | Yes | Person who acted, when a person acted.References app.people.id |
| action | text | No | What happened, as table.operation (for example membership_roles.insert) or a named act (for example dsar.exported). |
| subject_table | text | No | Table of the row acted on. |
| subject_id | uuid | Yes | Id of the row acted on. |
| diff | jsonb | No | Audit diff: the new values on insert, the old and new values of changed columns on update, the old values on delete. Restricted columns and hashes are never included. |
| actor_ip | inet | Yes | Client IP address of the request. Removed at redaction. |
| user_agent | text | Yes | Client user agent of the request. Removed at redaction. |
| request_id | text | Yes | Request id from the API, for correlating with logs. |
| redacted_at | timestamp with time zone | Yes | When personal data in diff, actor_ip and user_agent was redacted. |
| created_at | timestamp with time zone | No | When the row was inserted. Set by the database. |
| created_by | uuid | Yes | Person who inserted the row, or null for a platform process. Set by the database.References app.people.id |
| updated_at | timestamp with time zone | No | When the row last changed. Set by the database. |
| updated_by | uuid | Yes | Person who last changed the row, or null for a platform process. Set by the database.References app.people.id |
| deleted_at | timestamp with time zone | Yes | Soft delete time. A row with deleted_at set is ignored by every access helper. |