name: audit_logging description: Ensure every critical action is logged (vital for UAG/Trust Room). allowed-tools: Read, Edit, Write

Audit Logging Protocol

No Invisible Actions: Every state-changing API call (POST, PUT, DELETE) must produce a log entry.
Traceability: Logs must include
```
userId
```
,
```
action
```
,
```
resourceId
```
, and
```
metadata
```
.

Backend (API):

Use the project's standard Logger service (e.g.,
```
src/services/logger.ts
```
or similar).

Example:

await Logger.info({
  event: 'POST_CREATED',
  userId: user.id,
  metadata: { postId: newPost.id }
});

Database (Supabase):
- Ensure tables have
```
created_at
```
  ,
```
updated_at
```
  , and
```
created_by
```
  columns.
- Check if specific Audit Table inserts are required (e.g.
```
audit_logs
```
  table).

No Invisible Actions: Every state-changing API call (POST, PUT, DELETE) must produce a log entry.
Traceability: Logs must include
```
userId
```
,
```
action
```
,
```
resourceId
```
, and
```
metadata
```
.

Backend (API):

Use the project's standard Logger service (e.g.,
```
src/services/logger.ts
```
or similar).

Example:

await Logger.info({
  event: 'POST_CREATED',
  userId: user.id,
  metadata: { postId: newPost.id }
});

Database (Supabase):
- Ensure tables have
```
created_at
```
  ,
```
updated_at
```
  , and
```
created_by
```
  columns.
- Check if specific Audit Table inserts are required (e.g.
```
audit_logs
```
  table).