Audit & Logging

An environment you cannot reconstruct is an environment you cannot defend. The audit model exists to answer one question at any moment: what happened, to what, and by whom.

The evidence model

Every significant event in the mesh should capture four facts: who changed policy, which node or service was affected, what product surface was touched, and whether the event came from a human operator, automation token, runner, or gateway. An event missing any of these four cannot serve an incident review — it can only tell you that something happened.

Actor and request context

Events are recorded as structured records with actor context, request IDs, system activity, and operational history. Request IDs let you trace a single operation across coordinator, agent, and product service; actor context tells you which identity was responsible; the operational history ties it all into a timeline you can walk backwards from an incident.

Representative event shape

  {
    "id": "evt_01J2...",
    "request_id": "req_...",
    "actor": { "kind": "token", "id": "tok_builds", "scope": "builders" },
    "action": "acl.rule.updated",
    "target": { "kind": "acl", "id": "grants.builders" },
    "surface": "coordinator /v1",
    "timestamp": "2026-08-18T09:41:02Z"
  }

Product surface coverage

The audit model covers the product surfaces, not just the control plane: enrollment changes, access policy updates, product provisioning, Git activity, router configuration changes, and backup or restore operations. Rizoma Git, for example, maintains a complete audit trail for code changes, CI runs, package publishes, and access events, with custody chains and signed artifacts for deployment evidence.

Automation should consume these trails as signed event streams — the audit webhooks reference describes how to receive them for compliance export and operations handoff.

Metrics and health

The agent, coordinator, relay, ingress, and dashboard each expose health, readiness, info, and Prometheus metrics. Telemetry flows through the heartbeat alongside endpoints and E2E key material, so a node's health is observable from the control plane without opening extra ports. Use the metrics to detect drift from policy — a node whose ACL matches change without a corresponding audit event is a node that needs attention.

Make review a habit. The deployment flow includes verifying telemetry before production traffic — because the audit trail is only useful if it is complete before it matters.

Previous Zero-Trust Policies Next API Authentication