An audit log with no failures in it
Audit records are written to a table in the application database, in the same transaction as the action they describe. It looked like the safest possible design — the record can never disagree with what happened.
During an investigation someone notices the log contains only successful actions. Every denied authorization, every fired constraint, every rejected attempt rolled back — and took its own audit record with it.
Boundaries, outermost first: Application account: App database (transaction rolls back; FAILED: rolled back), Application, Request (may be denied) Write-only store: Audit store (append only) Outside every boundary: an empty slot for the survives a rollback Connections: Request calls Application (step 1) Application calls App database — rolls back (step 2) Application publishes to survives a rollback — written anyway (step 3) survives a rollback publishes to Audit store (step 4)