Audit and Compliance Basics

An audit trail that nobody trusts is worse than no audit trail. It creates false confidence. This closing episode covers what EchoFoundry's audit system actually captures and the operator habits that keep it trustworthy when you need it most.

What immutable audit means in practice

Every access decision, capability grant change, AI governance action (budget change, allowlist change, approval-gate decision), and administrative action across the core and every subscribed module writes to a single append-only audit log. "Immutable" means entries cannot be edited or deleted after the fact, including by administrators. The log is the log. This is what makes it usable as evidence during a compliance review or an incident investigation, rather than a record someone could quietly clean up afterward.

What gets captured

At minimum, expect every audit entry to record: who (which identity), what (the specific action and resource), when (timestamp), and the authorization basis (which capability grant made the action allowed or denied). For AI-governed actions specifically, expect the model used, the budget scope charged, and the approval-gate outcome to be captured alongside the action itself, so a later reviewer can reconstruct what happened and why it was permitted.

Legal hold and retention

When a legal hold is placed on a set of records or a time window, the underlying audit entries and referenced data are preserved beyond normal retention regardless of any standing deletion policy. As an operator, know how to identify what's currently under hold in your organization and treat that scope as read-only in practice, not just in policy. Do not attempt workarounds to "clean up" data that's under hold, even with good intentions.

SIEM export: getting the trail to where you already watch things

For organizations running a security information and event management pipeline, audit data can export into that existing pipeline rather than requiring your security team to learn and monitor a second system. Set this up early if your organization already has SIEM tooling. Retrofitting export after an incident has already happened is the wrong time to be wiring up integrations.

Operator habits that make the audit trail actually useful

The trail only helps you if you can navigate it under pressure. Build these habits before you need them:

• Know how to filter by resource and by identity, not just by date range: most real investigations start from "what happened to this specific record" or "what did this specific user do," not "show me last Tuesday."
• Practice a mock lookup periodically. Pick a real past incident (even a minor one) and reconstruct it purely from the audit trail. If you can't, that's a gap to fix before a real incident forces you to learn it live.
• Know your organization's retention window and legal-hold process well enough to answer a compliance question without paging someone else first.

Closing the loop with the rest of the platform

The audit trail is the place where every other governance mechanism in this course becomes verifiable after the fact: the capability grant that allowed an action, the budget that was charged, the approval gate that was or wasn't triggered. All of it is one queryable trail. Governance you can't audit is a policy document. Governance you can audit is a system you can actually trust.

Field exercise

Pick one action you or a colleague took in EchoFoundry in the last month (an approval, a permission change, an agent-assisted customer response). Using only the audit trail, reconstruct who did it, when, under what capability grant, and, if AI-governed, which model and budget were involved. Note anything you expected to find that wasn't there, and flag it for review.