> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/core-concepts/audit-and-compliance.md). # Audit and Compliance The **audit trail** is AOH Sync's unified, compliance-grade log of every action that changes state. It is not debug logging and not optional: if an operation mutates data, it leaves an audit entry. ## What every entry captures * **Actor type and actor ID** - who or what performed the action. Human admins, services, and automated processes are all distinguishable. * **Action** - what was done. * **Entity type and entity ID** - what was acted upon. * **Compliance tags** - which frameworks care about this event (e.g. SOX, HIPAA, SOC 2). Because both human and non-human actors are recorded by type, an automated change is as attributable as a human one. There is no anonymous "the system did it". ## Compliance tags Entries are tagged with the frameworks they are relevant to, and the trail is indexed so tagged entries can be retrieved efficiently. Retrieving every SOX-relevant change in a period is a direct query, not a manual hunt through unstructured logs. ## Decisions, not just changes AOH Sync also records reviewed-and-set-aside decisions: * A [dismissed orphan](/core-concepts/orphans.md) logs that someone reviewed it and set it aside. * An [acknowledged anomaly](/core-concepts/posture-and-anomalies.md) logs that someone saw and judged it. * A [machine identity ownership transfer](/core-concepts/machine-identities.md) logs who inherited what and when. "We knew and decided" and "we never noticed" look identical in a system that only logs changes. AOH Sync logs the deciding, so the two are never confused. ## Ties to the principles * A single writer per kind of data means every change has a clear origin. * [Backend-authoritative](/core-concepts/access-control.md) access means every action was authorized before it ran, and that authorization is recorded. * State changes flow through recorded events, so the trail is complete, not best-effort. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.aohwv.dev/core-concepts/audit-and-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.