Audit and Compliance

The audit trail is AOH Sync's unified, compliance-grade log of every action that changes state. It is not debug logging and not optional: if an operation mutates data, it leaves an audit entry.

What every entry captures

• Actor type and actor ID - who or what performed the action. Human admins, services, and automated processes are all distinguishable.
• Action - what was done.
• Entity type and entity ID - what was acted upon.
• Compliance tags - which frameworks care about this event (e.g. SOX, HIPAA, SOC 2).

Because both human and non-human actors are recorded by type, an automated change is as attributable as a human one. There is no anonymous "the system did it".

Compliance tags

Entries are tagged with the frameworks they are relevant to, and the trail is indexed so tagged entries can be retrieved efficiently. Retrieving every SOX-relevant change in a period is a direct query, not a manual hunt through unstructured logs.

Decisions, not just changes

AOH Sync also records reviewed-and-set-aside decisions:

• A dismissed orphan logs that someone reviewed it and set it aside.
• An acknowledged anomaly logs that someone saw and judged it.
• A machine identity ownership transfer logs who inherited what and when.

"We knew and decided" and "we never noticed" look identical in a system that only logs changes. AOH Sync logs the deciding, so the two are never confused.

Ties to the principles

• A single writer per kind of data means every change has a clear origin.
• Backend-authoritative access means every action was authorized before it ran, and that authorization is recorded.
• State changes flow through recorded events, so the trail is complete, not best-effort.