Attribute serving decisions without turning logs into a secret store

Capture the authenticated principal and tenant, the service actor executing on its behalf, canonical model/version/adapter or document identifiers, action, policy version, decision, reason category and operation correlation ID. Treat caller-provided request IDs and claimed usernames as untrusted fields with a separate label. If retries or delegation occur, preserve their relationship to the original operation without inventing a single actor for the whole chain. Record timestamps and clock domain/uncertainty where cross-service ordering matters.

A decision event should identify what was checked and when, including a policy snapshot or lease if used. An execution event should describe the actual target and outcome, while a reservation event records its own accounting transition. Correlation helps reconstruct these stages but does not make an incomplete trace complete. Use bounded reason codes and verified resource references so operators can investigate a denial without logging full confidential documents, generated answers or model parameters.

Exclude access tokens, passwords, secret keys and unnecessary sensitive prompt/document content from ordinary security events. A diagnostic mode must not quietly disable this rule across production traffic. If correlation requires a protected pseudonymous reference, define its access and key/rotation policy; hashing a low-entropy secret is not automatically safe anonymization. Logs themselves need tenant-appropriate access, retention and deletion policy because even resource names and usage patterns can reveal confidential relationships.

Use a structured encoding and bounded field lengths so a supplied string cannot forge another event with control characters or delimiters. Validate fields from other trust zones, safely represent or omit the bad field, and preserve the security event with an appropriate reason. Protect event transport and storage, and distinguish tamper evidence from complete event capture. A hash chain without a trusted retained checkpoint does not by itself show that a tail was not deleted or that missing events ever existed.

Inject controlled collector downtime, malformed log fields and storage-pressure conditions, then compare an independent operation ledger with collected events. Count missing, duplicate and delayed records using their stable event IDs. Specify whether a security-critical action fails closed, uses durable local buffering or follows another explicit policy when auditing is unavailable; there is no universal correct choice for every action. A best-effort stdout write is not automatically a durable audit receipt or exactly-once delivery.

The queue lab illustrates one finite-rate delivery-pressure term. Reset, set both λ=4,μ=2, predict backlog twelve at t=4, then take eight Steps. Reset and set both λ=2,μ=4 predicts zero at t=4 from initial four. Edits pause while retaining time, so reset and set both rates before comparison. The fluid model contains no durable store, event identities, secret redaction, finite buffer, drops or acknowledgments. Real audit completeness requires the independent ledger and actual failure-path tests.