wtf( )unctionsystem design, drawn
← all problemsSecurityHard

An audit log with no failures in it

Audit records are written to a table in the application database, in the same transaction as the action they describe. It looked like the safest possible design — the record can never disagree with what happened.

During an investigation someone notices the log contains only successful actions. Every denied authorization, every fired constraint, every rejected attempt rolled back — and took its own audit record with it.

Make the record survive the thing it's recording.
Components — tap one, then tap a slot on the diagram
!The audit log contains no failed attempts at all.

Boundaries, outermost first: Application account: App database (transaction rolls back; FAILED: rolled back), Application, Request (may be denied) Write-only store: Audit store (append only) Outside every boundary: an empty slot for the survives a rollback Connections: Request calls Application (step 1) Application calls App database — rolls back (step 2) Application publishes to survives a rollback — written anyway (step 3) survives a rollback publishes to Audit store (step 4)

App databasetransaction rolls backrolled back
Audit storeappend only
Application
Requestmay be denied