Audit logs are tenant-scoped

Audit logs that are not scoped by tenant become a cross-tenant intelligence source: a tenant admin can query another organization's activity history, exposing who is active, what features they use, and what actions their users take. CWE-285 and NIST AU-9 both address this; SOC 2 CC7.2 requires that audit records be protected from unauthorized access. Beyond privacy, unscoped audit logs mean a legitimate tenant admin cannot be confident that the logs they see reflect only their organization's actions.

Add organizationId as a required field on every audit log write and as a mandatory filter on every read:

// Write — include tenant context on every event
await db.auditLog.create({
  data: {
    organizationId: session.user.organizationId,
    userId: session.user.id,
    action: 'document.deleted',
    resourceId: docId,
    createdAt: new Date()
  }
})

// Read — always scope to the requesting tenant
const logs = await db.auditLog.findMany({
  where: { organizationId: session.user.organizationId },
  orderBy: { createdAt: 'desc' },
  take: 100
})

If the audit log table was created without an organizationId column, add it via migration and backfill from the related resource's organizationId before removing the global-read path.