What the platform recorded
R-S-04 requires an immutable log, and 04 already argues that permissions alone cannot make one tamper-proof. The prototype writes to a capped browser cookie over a seeded fixture history. What it demonstrates is the schema, the event vocabulary and — the part that actually needs reviewing now — that refusals are rows. Append-only storage with separated duties is a fullstack item (A-70), and claiming otherwise here is the kind of false that gets quoted back in an audit.
| WHEN | ACTOR | ACTION | RESOURCE | DECISION | BASIS |
|---|---|---|---|---|---|
| 2026-09-23 06:12 | Le Thi Mai (Telesales agent, North) viewer | denied | metric:CG-01 | DENY | R-S-03 / A-26 — row-level scope by org unit Direct Disbursement Ratio belongs to Corporate Governance; reader is scoped SALES-TS-N |
| 2026-09-22 09:31 | Le Thi Mai (Telesales agent, North) viewer | denied | integrations:all | DENY | R-S-13 / A-34 — an operational role in a data pipeline No operational role; the console lists key fingerprints and schedules |
| 2026-09-21 02:55 | Nguyen (Member's Council) board | denied | campaign:create | DENY | A-26 — a read-only persona has no accountable role for a write Member's Council is read-only by design. LOOMS RBAC could not express this refusal |
| 2026-09-19 10:18 | Head of Infrastructure & Operations dept_head | denied | pack:SALES-TS | DENY | R-S-03 / A-26 — row-level scope by org unit Telesales pack requested; reader is scoped IT-INFRA |
| 2026-09-18 02:43 | Le Thi Mai (Telesales agent, North) viewer | denied | explain:chart:vintage-curves | DENY | R-S-18 — an assistant that summarises anything is a scope bypass with a friendly voice Refused aloud; no number reached the browser |
A log of successful actions answers “who read this?” and not “who tried?” — and the second is the question a quarterly access recertification (R-S-11) turns on. 5 of the 14 rows here are refusals, each naming the rule that produced it. A refusal with no basis would be noise; a refusal with one is a finding.
You are reading the full log because Internal Audit and executives are the roles it is written for — and this read is itself an event. Q-31 asks ACF for the retention period and who may export it.