Audit logs make appeals, incident review, and accountability possible. The Audit Logging Policy defines what events are logged (access, moderation actions, civic routing, AI-involved decisions, configuration changes), the log integrity posture (tamper-evident where possible), the retention period by log category, the access controls on logs, and the rules that prevent audit logs from becoming surveillance datasets.
It applies to engineering, security, moderation, and compliance functions.
Requirements
- Log moderation actions, AI-involved decisions, access events, and configuration changes.
- Protect log integrity with documented tamper-evident measures.
Prohibitions
- Do not use audit logs as a surveillance dataset.
- Do not retain audit logs past the documented retention period.