Audit Logging Protocol

1. Principles

• No Invisible Actions: Every state-changing API call (POST, PUT, DELETE) must produce a log entry.
• Traceability: Logs must include userId, action, resourceId, and metadata.