Auditors ask for shipment edit history; IT sends gigabytes of logs. Logs are not audit: audit needs who, when, which business record, what action, old and new values. Applications must write business audit tables queryable by document. Ops logs serve incidents—not compliance. Treat them as the same and audits disappoint both auditors and SRE.
grep-able is not court-ready. Evidence needs structure, tamper resistance, and account binding.
Minimum Business Audit Set
Login and permission changes, document create/edit/delete, export, approval, price and quantity fields. Record operator (no shared accounts), time, document number, field old/new values. Retention per regulation; query by document in seconds.
- Admin edits audit too—superuser is not exemption.
- Agent actions log initiator plus tool name.
- Audit tables append-only; cleanup via archive policy—not "disk full, delete."
Replay by Document Is Audit
The XYN digital intelligence system writes key operations to business audit—factory and internal audit open by document number. Logs stay with SRE. Split the two and compliance cost drops—no more using on-call as the audit query engine.
Drill one order changed in the last three months—can you produce old/new quantity in ten seconds? If not, you have logs—not audit.
