AutoCore Security Logging and Auditability
Documents the append-only audit convention, high-risk actions, exports, and limits.
Audit history supports accountability for high-risk application actions. It is a service-level append-only convention, not a claim that the underlying datastore is tamper-proof or independently immutable.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| High-risk | Role changes, session revocation, payment/refund/provider actions, media mutations, and integrity repairs are audit-relevant. |
| Read access | Admin audit exploration is read-only and permission-gated. |
| Export | CSV output is capped at 5,000 rows and formula-safe; treat exports as sensitive evidence. |
| Privacy | Admin responses exclude IP and user-agent fields in the reviewed explorer contract. |
| Retention | Retention and external immutability require an operator policy and storage control outside this source claim. |
High-risk operation
Use explicit authorization, a written reason, a confirmation gate, and post-action verification. Documentation does not grant permission to change a deployment.
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.