What the platform recorded
R-S-04 requires an immutable log, and 04 already argues that permissions alone cannot make one tamper-proof. The prototype writes to a capped browser cookie over a seeded fixture history. What it demonstrates is the schema, the event vocabulary and — the part that actually needs reviewing now — that refusals are rows. Append-only storage with separated duties is a fullstack item (A-70), and claiming otherwise here is the kind of false that gets quoted back in an audit.
| WHEN | ACTOR | ACTION | RESOURCE | DECISION | BASIS |
|---|---|---|---|---|---|
| 2026-09-23 06:40 | Internal Auditor auditor | view | audit:all | ALLOW | R-S-04 — the log is reusable as J-SOX and Internal Audit evidence Quarterly access recertification — 26 employees, 10 personas |
| 2026-09-23 06:12 | Le Thi Mai (Telesales agent, North) viewer | denied | metric:CG-01 | DENY | R-S-03 / A-26 — row-level scope by org unit Direct Disbursement Ratio belongs to Corporate Governance; reader is scoped SALES-TS-N |
| 2026-09-23 05:58 | Vu Tuan Minh (CEO) exec | export | report:monthly/2026-08 | ALLOW | R-S-08 — export is a permission: controlled, watermarked and logged CSV · 24 exceptions · scope ACF |
| 2026-09-22 09:31 | Le Thi Mai (Telesales agent, North) viewer | denied | integrations:all | DENY | R-S-13 / A-34 — an operational role in a data pipeline No operational role; the console lists key fingerprints and schedules |
| 2026-09-22 08:14 | Metric owner (Corporate Governance) metric_owner | certify | metric:CG-02 | ALLOW | R-G-07 — certification requires the metric owner's sign-off Attempted tier move managed → certified; reconciliation not attached, left at managed |
| 2026-09-21 03:20 | Thuy (Head of Telesales) dept_head | create | campaign:cmp-contactability-h2 | ALLOW | R-P-25 — a campaign names an accountable owner Goal TS-03 ≥ 4.5; guard TS-08 attached automatically (R-G-17) |
| 2026-09-21 02:55 | Nguyen (Member's Council) board | denied | campaign:create | DENY | A-26 — a read-only persona has no accountable role for a write Member's Council is read-only by design. LOOMS RBAC could not express this refusal |
| 2026-09-20 07:45 | Shiozawa (GM, Operations) gm | view | pack:OPS-COLL | ALLOW | R-S-03 — read within your own org-unit scope Collections pack, 12 metrics |
| 2026-09-20 06:02 | Data owner (IT System Planning) data_owner | view | project:int-telesales-stringeex-7f3a | ALLOW | R-S-13 / A-34 — an operational role in a data pipeline Feed health review — 2 consecutive misses |
| 2026-09-19 10:18 | Head of Infrastructure & Operations dept_head | denied | pack:SALES-TS | DENY | R-S-03 / A-26 — row-level scope by org unit Telesales pack requested; reader is scoped IT-INFRA |
| 2026-09-19 04:11 | HR Business Partner hr_bp | view | individual:E-1041 | ALLOW | A-45 — reporting-line row scope, HR business partner for this unit Layer-4 scorecard read; the subject can see this row in their own log |
| 2026-09-18 08:00 | Vu Tuan Minh (CEO) exec | switch_persona | persona:gm-ops | ALLOW | A-26 — the persona switcher replaces auth in the prototype ⚠ Prototype-only event. At fullstack this action does not exist |
| 2026-09-18 02:43 | Le Thi Mai (Telesales agent, North) viewer | denied | explain:chart:vintage-curves | DENY | R-S-18 — an assistant that summarises anything is a scope bypass with a friendly voice Refused aloud; no number reached the browser |
| 2026-09-18 02:41 | Le Thi Mai (Telesales agent, North) viewer | explain | metric:TS-03 | ALLOW | R-S-18 — assistant answers are scope-bounded Contactability explained; in scope |
A log of successful actions answers “who read this?” and not “who tried?” — and the second is the question a quarterly access recertification (R-S-11) turns on. 5 of the 14 rows here are refusals, each naming the rule that produced it. A refusal with no basis would be noise; a refusal with one is a finding.
You are reading the full log because Internal Audit and executives are the roles it is written for — and this read is itself an event. Q-31 asks ACF for the retention period and who may export it.