Portal Community
Use Case

Audit Trail for Regulated Industries

Build a tamper-evident, PII-free audit record of every guard violation — queryable by TenantId, UserId, GuardName, and TraceId — without slowing down workflow execution.

What Gets Audited

Every time a guard returns IsAllowed=false, GuardRailsAuditLogger writes an audit event. The audit logger operates asynchronously in batches — violations never block the execution path.

Audit Event Structure

public class GuardRailViolationAuditEvent
{
    public DateTime OccurredAtUtc { get; set; }
    public int TenantId { get; set; }
    public int? UserId { get; set; }
    public string GuardName { get; set; }    // e.g. "PiiDetectionGuard"
    public GuardRailPhase Phase { get; set; } // Pre=0, Post=1, Error=2
    public string OperationId { get; set; }  // unique per node execution
    public string Reason { get; set; }       // human-readable violation description
    public string TraceId { get; set; }      // distributed trace correlation
    public string SourceIp { get; set; }

    // NOTE: No Input or Output snapshots.
    // The allowlist approach: log metadata, never log the data itself.
}
No PII in Audit Logs — Ever The audit event contains no Input or Output snapshots. This is by design (the "allowlist approach"). If PII was in the input, the fact of the violation — which guard blocked, at what time, for which tenant — is sufficient for compliance evidence. The actual data is never written to the audit store.

Audit Trail Structure

Each GuardRailViolation in the execution result also carries audit-relevant fields:

public class GuardRailViolation
{
    public string GuardName { get; set; }
    public GuardRailPhase Phase { get; set; }
    public string Reason { get; set; }
    public long TenantId { get; set; }
    public string OperationId { get; set; }
}

Execution Timeline for Forensics

The GuardRailsExecutionTimeline in each execution result provides guard-by-guard forensics:

// Sample timeline output
Guard Timeline:
  TimeoutGuard       (pre, 2ms)   ✓
  RateLimitingGuard  (pre, 5ms)   ✓
  PiiDetectionGuard  (pre, 12ms)  ✗  [BLOCKED: SSN, Email detected]

This tells you exactly which guard blocked, in which phase, how long it took to make the decision, and why.

Compliance Scenarios

GDPR Data Protection Audit

Regulator asks: "Show us evidence that personal data was not processed without lawful basis for TenantId 42 between January and March 2026."

PCI-DSS Cardholder Data Access Audit

Auditor asks: "Was credit card data ever returned in an API response?"

SOC 2 Rate Limiting Evidence

Auditor asks: "How do you prevent one customer from monopolizing shared infrastructure?"

Secrets Redaction in Logs

ISecretsRedactor is applied to all log output. It uses regex-based detection to scrub:

This ensures that even if a node logs its own input, any secrets in that input are redacted before they reach the log aggregator.

Non-Blocking Audit Design

Audit writes never delay workflow execution GuardRailsAuditLogger writes violations asynchronously in batches. A brief window exists where a violation may not yet be persisted — acceptable for all known regulatory frameworks where near-real-time audit is sufficient. The trade-off is zero performance impact on the execution hot path.
← Input Validation Email Redaction →