Audit & compliance logging

Purpose: Be able to prove who did what — content, permissions, code and config — with evidence that survives scrutiny.

Audience	Why it matters to you
Tech leads	Evidence owners
Platform engineers	Plumbing owners

The questions an auditor (or incident) asks

Question	Evidence source
Who changed this page and when?	Page audit log (cq audit events) + versions
Who published it?	Replication/audit events; workflow history if via approval (Lab 9 trail)
Who had access to X on date Y?	Group membership snapshots (periodic export — point-in-time answers need point-in-time data)
Who changed permissions?	ACL change events + the change request that authorised it
What code/config was live on date Y?	Git tags + deployment records (pipeline annotations)
Who logged in / failed to?	Auth logs shipped to the log platform (log management)

Export, don't hoard: in-repo audit nodes (/var/audit) get purged for repo health (maintenance); compliance retention lives in the log platform with its own retention clock. Ship audit events out continuously — the purge job and the auditor stop fighting.
Attribution requires the identity discipline you already built: humans via SSO (no shared logins), code via purpose-named service users — admin did it is the evidence equivalent of a shrug.
Time sync (NTP) across the fleet, UTC in exports — cross-system timelines die on clock skew.
Access to audit data is itself audited and least-privilege.

Review	Cadence	Artefact
Access review (groups vs business owners)	Quarterly	Signed-off membership report (governance)
Service-user grant review	Quarterly	ACL dump + justifications (service users)
Admin/break-glass usage	Monthly	Usage log with reasons
Audit pipeline health	Monthly	"Is the evidence still flowing" check — discovering at audit time it stopped in March is the classic