# Audit

**Test family:** `AUD`

- **AUD-001** Record who, acting-as/delegated identity, what, object, tenant, before/after, when, source, request/run correlation, and outcome.
- **AUD-002** Include create/update/delete/archive/restore, permission/policy, login/security, import/export, automation, AI/tool, and failed sensitive attempts per policy.
- **AUD-003** Timestamps/order remain meaningful under concurrency, delayed events, clock skew, retry, and backfill.
- **AUD-004** Retry/duplicate delivery does not fabricate separate human actions; legitimate repeated action remains distinct.
- **AUD-005** Audit is append-only/tamper-evident to unauthorized actors and protected from deletion by subject.
- **AUD-006** Sensitive values/secrets are redacted while changes remain diagnosable; access to audit itself is authorized/audited.
- **AUD-007** Search/filter/export/retention/legal hold preserve completeness at scale and tenant isolation.
- **AUD-008** A failed action does not appear successful; partial action records exact committed effects.

## Comprehensive per-item coverage

- **AUD-009** Exercise no match, one match, many matches, and boundary-size batches with ordinary and adversarial records.
- **AUD-010** Use text values containing emoticons, emoji, kaomoji, RTL, combining marks, quotes, delimiters, and newlines; preserve comparison and substitution semantics.
- **AUD-011** Deliver the same event once, twice, late, out of order, and after replay; define deduplication and event-time behavior.
- **AUD-012** Race matching events and concurrent workflow instances against the same record; prevent lost updates and duplicate effects.
- **AUD-013** Retry before commit, after commit before acknowledgment, and after downstream partial success; use stable idempotency.
- **AUD-014** Change the condition, template, permission, owner, or target after scheduling but before execution; define snapshot versus latest semantics.
- **AUD-015** Run across daylight-saving gaps/folds, leap day, month end, differing tenant zones, clock skew, and delayed workers.
- **AUD-016** Pause, resume, disable, edit, clone, publish, roll back, and delete while runs are queued or active; preserve version identity.
- **AUD-017** Create direct, indirect, and cross-workflow loops; detect recursion, cap fan-out, and expose why execution stopped.
- **AUD-018** Test missing fields, nulls, type changes, unknown enums, deleted references, schema migrations, and malformed payloads.
- **AUD-019** Run as creator, owner, service identity, changed-role user, removed user, and least-privilege actor; define execution authority explicitly.
- **AUD-020** Cross tenant, workspace, region, and environment boundaries only when explicitly authorized; prevent shared caches or queues from leaking data.
- **AUD-021** Force dependency timeout, rate limit, quota, authentication expiry, malformed response, and permanent rejection; route each to a defined failure path.
- **AUD-022** Verify compensation or rollback for partial multi-step work, including a compensation failure and manual recovery.
- **AUD-023** Measure queue delay, execution latency, throughput, fan-out, backlog, and recovery under the supported load envelope.
- **AUD-024** Provide dry-run or preview where consequences justify it; identify evaluated inputs, matched conditions, and proposed actions without mutation.
- **AUD-025** Verify alerting distinguishes user-data failure, configuration failure, platform failure, and exhausted retries without notification storms.
- **AUD-026** Record immutable version, trigger/event ID, evaluated conditions, actor, permissions, each attempt, side effect, and final outcome without secrets.
- **AUD-027** Replay a historical event against the same and newer definition in an isolated mode; make semantic changes visible.
- **AUD-028** Recover after worker crash, queue redelivery, regional failover, and prolonged outage without losing or duplicating committed work.

[Back to Automation, rules, permissions, and audit index](../../automation-rules.md)
