AuditLogging
Immutable record of who did what, when — for compliance/accountability, distinct from application logs (Observability/Logging).
Why we need this / what value this brings
Provides a tamper-evident record of who did what, which is what you need when investigating a dispute or a security incident, not just debugging.
When to use this
Any admin action, permission change, or access to sensitive data (payment info, PII).
How to use or implement this
Log to an append-only store, separate from regular application logs, including actor, action, target, and timestamp.
Research questions
- Does Localz log admin actions (e.g. a dispute resolution, a manual refund) in a way that's tamper-evident?
Empty folder — drop notes, links, and findings here as you research.