Decision evidence
An authorization decision log explains what was requested, which policy and facts were evaluated, what result was produced, and what the enforcement point did. It supports incident response, policy review, regression analysis, compliance evidence, and dispute resolution.
Minimum useful record
Record a time and correlation identifier; authenticated subject and originating actor; target resource and action; relevant context identifiers and freshness; policy and evaluator version; result and reason code; enforcement result; and the services involved. Use stable identifiers that can join the decision to application and identity events.
Protect the evidence
Classify the log as security-sensitive. Restrict write and read access, protect integrity, define retention, synchronize time, monitor collection gaps, and test retrieval. Redact credentials, bearer tokens, cookies, private keys, sensitive attributes, and full object data. Store a reference or safe digest when the raw value is not needed.
Failure and residual risk
An allow log without the enforcement result cannot prove access occurred. A reason string without a policy version cannot reproduce the decision. Excess context can create a high-value privacy store. Sampling can omit rare denials or abuse. An attacker with log access can erase or forge evidence unless the pipeline limits that authority.
Pomerium boundary
Pomerium audit logs provide evidence for identity-aware route decisions and proxy activity. Applications must log their own object and action authorization. Correlation identifiers should connect the gateway decision to the upstream decision without copying credentials between systems.
Evaluation checklist
- Can one record identify subject, actor, resource, action, policy version, result, and enforcement?
- Can an investigator correlate the gateway and application decisions?
- Are secrets and unnecessary personal data excluded?
- Can the team detect log loss, clock drift, mutation, and unauthorized access?
- Can a reviewer reproduce a representative decision from retained evidence?
