Administrative Audit Logs

Append-Only

Dedicated IAM Control Plane audit stream stored in public.iam_admin_audit_events.

Database Security: INSERT/SELECT Only

Immutable Event Trail

Captures all control plane administrative calls, RBAC authorization decisions, step-up challenges, and session state transitions.

Runtime Plane Untouched

public.security_audit_events remains 100% untouched and reserved for marketplace runtime operations.

Automated Redaction

All secrets, tokens, passwords, credentials, and PII are recursively scrubbed to [REDACTED] before persisting.

Non-Secret Session Hashing

Raw session IDs and tokens are SHA-256 hashed into irreversible session references for safe auditing.