Audit logs are usually designed by nobody. They accrete: a developer adds a line here, a compliance ticket adds a field there, and the result is a table that technically contains the truth and practically conceals it.
The audit log has users, and they arrive on the worst day: an incident review, a subject-access request, a regulator’s question. Someone who did not write the system reads it under pressure, looking for one event among millions.
01 · DESIGN IT LIKE A READ-OUT
Everything we argue about dense interfaces applies here: rank by relevance to the question being asked, compress the steady state, make the exceptional entry loud. A log that renders every event with identical weight is a wall; a log that knows "permission changes are what reviews look for" is a tool.
02 · THE MISCONFIGURATION LOOP
A readable log has a second effect. Operators check it after making changes, and catch their own misconfigurations within minutes instead of at audit time. A readable audit trail is the fastest feedback loop in the whole permission system.
03 · A WORKED TAXONOMY
Our working taxonomy has five event families. Grant: someone’s access widens. Use: someone exercises the access. Denial: the system refuses an attempt. Change: the rules move. An admin edits a role, replaces a policy, or shortens the log’s own retention. Silence: a review window closes with no events, and the log stores the empty window as a fact.
Denial and silence earn their place. A refused attempt signals a misconfiguration or an attack. You want to read about both on the day they happen, not at quarter’s end. Silence turns the log into evidence. "Nobody accessed this record during the review period" becomes a line you produce on demand, not a query you run and hope.
Every event answers four questions in the same order. Who acted. What they touched. On whose authority. What changed. Reviews search the authority column first, and most logs omit the column. Link the grant behind each event instead of implying the grant. With the link on the surface, you walk the chain in minutes. Without the link, someone writes a join at audit time and the walk takes the afternoon.