Security Audit Logging

Version boundary

Target Spring Boot 3 with Spring Framework 6 and Spring Security 6. Check the selected release's Actuator audit APIs before wiring listeners. The shipped Java 17 record has no Boot/Jackson dependency and is shared across both trees.

Event contract

Choose events needed for the requested security or business requirement: authentication decisions, access denial, privilege changes, sensitive exports and administrative actions. Separate attempted, denied, successful and failed operations. Do not log SUCCESS before the authoritative transaction commits.

Prefer typed fields: event ID, UTC time, verified actor ID, tenant ID, action, target ID, outcome and server-generated correlation ID. Unauthenticated events may have no actor; do not mislabel a supplied username as verified identity. Record only identifiers needed for the investigation, with controlled access and retention.