The audit trail names the upstream component as initiator of a downstream action. What does that record prove?

## What an audit record is for An audit trail answers questions of the form *who did what, when, with what authority*. It is built to support accountability for **effects**: this principal made this call, these were the argument values, here is the timestamp and the correlation identifier. It is extremely good at that, and people routinely ask it a different question it was never built to answer: *why did this happen, and whose idea was it?* ## What the record establishes In a composed path — an upstream component reads outside material and hands a finding to a downstream component that acts — the trail typically shows: - the **actor**: the downstream component, running under its own service identity; - the **authority**: the role or grant under which the call was permitted; - the **requested_by** or correlation field: the upstream component, because the work arrived from it; - the **arguments**: the values the call actually carried. Every one of those entries is true. Together they describe an entirely ordinary operation, which is the first thing to internalise: there is no anomaly in the record to find. The action was permitted, the identity was legitimate, the arguments were well-formed. ## What the record does not establish Three gaps matter, and naming them precisely is the whole of this question. **1. It does not record who chose the argument values.** The `arguments` object shows the values that were passed. It does not show whether they were derived from a policy, computed from a typed field, or written by a model reading prose. In a laundered path the values are the artefact of interest, and their provenance is exactly the field that is missing. **2. It does not carry the prose that motivated the call.** The free-text member of the handoff — the `notes` or `rationale` — is what steered the reader. It is a payload field in an application message, not an audit field, so it is normally absent from the trail or truncated in it. A reconstruction that depends on it is a reconstruction, not a log finding. **3. It credits the wrong principal with the intent.** `requested_by` names the upstream component because that is where the request came from. But the upstream component did not *decide* anything; it restated material an outsider composed. The result is the characteristic shape of this class: the strongest principal in the chain acting on the weakest one's reading, with the trail attributing the action to the internal, trusted identity. ## Why this bites hardest across an organisational boundary When the reading and acting components belong to different organisations — a vendor component embedded in a customer's product — the two halves of the trail live in two systems with two retention policies and two release cadences. The customer sees a well-formed request from a known partner identity and a permitted call. The vendor sees an ingest and an emission. **Neither side's records contain the moment outside text became internal text**, because that transition is not an event either system logs; it is a consequence of topology. Triage across that seam is therefore always partly inferential, and the honest write-up says which parts. ## How to use it anyway The trail is not useless — it is just narrower than people assume. It reliably gives you: - **scoping**: which calls ran, so which effects are in play; - **timing and correlation**: which handoff the call followed, which bounds the window in which the material arrived; - **authority**: which grant permitted the call, which tells you what the same path could have reached but did not. What you add on top — that the argument values were shaped by prose in a specific handoff member — is an inference supported by the timing and the shape of the arguments, and should be written as one. ## The claim to avoid Do not write *the vendor component instructed our automation to do this*. It is what the field literally says and it is misleading in a way that will send the response to the wrong place: it turns a composition defect into a partner-behaviour allegation. The accurate sentence is that the downstream component acted at its own authority on a request whose free-text content came, ultimately, from outside — and that no record in either system distinguishes that from a normal day.