Sensitive operations are recorded in an audit log

PCI-DSS Req 10.2 mandates logging of all access to payment-related system components, including who performed actions and when. SOC 2 CC7.2 requires detection and logging of security-relevant activities. CWE-778 covers the failure directly: sensitive operations performed without an audit trail leave you unable to answer the most common post-incident questions — "when did this role change happen?", "who approved this data export?", "what did this admin do?" Application logs are insufficient because they are ephemeral, mutable, and not designed for forensic analysis. OWASP A09 identifies missing audit trails as a primary monitoring failure. A breach investigation without an audit log typically takes 3–5x longer and often cannot establish the timeline of events at all.

Create a persistent audit_events table and call an insert function from every handler that performs a sensitive operation.

Minimum schema:

CREATE TABLE audit_events (
  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
  actor_id    UUID REFERENCES users(id),
  action      TEXT NOT NULL,      -- e.g. 'user.role.changed'
  resource    TEXT NOT NULL,      -- e.g. 'user', 'subscription'
  resource_id TEXT NOT NULL,
  metadata    JSONB,              -- old/new values, IP address, etc.
  ip_address  INET
);

Call it from sensitive handlers:

await createAuditEvent({
  actorId: session.user.id,
  action: 'subscription.cancelled',
  resource: 'subscription',
  resourceId: subscriptionId,
  metadata: { reason: body.reason }
})

Target handlers: role changes, account deletion, subscription changes, payment processing, data exports, and all admin API calls. Application logs alone — even structured ones — do not satisfy this requirement.