Evidence with limits
Security logging records facts needed to detect, explain, and respond to access events. Sensitive security logging also treats the evidence pipeline as a protected system. Logs can contain user identifiers, resource names, network data, policy reasons, request fields, and application actions. They must not become a credential store or an unbounded copy of protected content.
Minimize and protect
Define the investigation question before selecting fields. Record stable correlation identifiers, subject and actor identifiers, route, resource class, action, policy version, decision, reason code, enforcement result, target result, and time. Use token or credential fingerprints when correlation is necessary. Never record bearer tokens, cookies, private keys, authorization headers, or raw secrets.
Authenticate producers, protect transport, restrict write and read access separately, use append or tamper-evident controls where the threat model requires them, synchronize time, detect gaps, and isolate high-authority log administration. Set retention by operational and investigation need. Delete data after the period and test deletion.
Failure and residual risk
An attacker can delete or forge local logs, inject line breaks or fields, flood the pipeline, exploit a logging library, or steal credentials that an application recorded. A shared correlation identifier can become cross-tenant tracking. Excessive redaction can remove the fact needed to explain a decision.
Logs show what instrumented systems reported. They do not prove that an unmonitored bypass path did not exist. Correlate independent sources.
Pomerium boundary
Pomerium can emit access and authorization fields described in its documentation. Operators own destination security, retention, access, redaction, availability, integrity, and correlation with identity-provider and application evidence. Pomerium cannot provide the application's final object action unless the application records it.
Evaluation checklist
- Does each field answer a defined detection or investigation question?
- Are credentials, secrets, unnecessary content, and excessive personal data excluded?
- Are producers, transport, storage, readers, administrators, and time protected?
- Can the system detect missing, duplicated, injected, delayed, and tampered events?
- Can one decision be correlated with the final application action and retention deletion?
