Admin can view but not modify tenant data without an audit trail

Platform admin routes that can write tenant data without logging are invisible to both the tenant and to compliance auditors. CWE-778 (Insufficient Logging) and OWASP A09 (Security Logging and Monitoring Failures) both apply; SOC 2 CC6.8 explicitly requires that privileged actions be logged with who, what, and when. The practical risk is that an insider threat — a rogue admin or compromised admin account — can modify or delete tenant data with no forensic trail, making incident response and regulatory defense impossible.

Wrap every admin write route in a logging function that captures the actor, action, affected tenant, and resource before returning:

// src/lib/admin-audit.ts
async function adminUpdateUser(
  adminId: string,
  targetUserId: string,
  changes: Partial<User>
) {
  const updated = await db.user.update({
    where: { id: targetUserId },
    data: changes
  })
  await db.adminAuditLog.create({
    data: {
      adminUserId: adminId,
      action: 'user.update',
      targetUserId,
      targetOrganizationId: updated.organizationId,
      changes: JSON.stringify(changes), // redact sensitive fields like passwords
      timestamp: new Date()
    }
  })
  return updated
}

In src/app/api/admin/, require this wrapper pattern for every POST, PATCH, PUT, and DELETE handler. Read-only GET handlers do not require the same trail but should still be access-controlled.