Evidence

Audit

Review the decision stream for identity, RBAC, tenant, app, recovery, session, and agent operations.

Events

Audit coverage

3 items

Audit must answer who did what, in which scope, through which channel, and why.

Identity and registration OS bootstrap, invitations, approval, credential setup, and principal state changes.

RBAC and access reviews Permission checks, role grants, custom-role decisions, and periodic reviews.

Tenant and app operations Tenant creation, activation, app access, domain readiness, and integration changes.

Governance

3 items

Audit is useful when it drives regular decisions, not just incident response.

Daily queue review Clear pending approvals, blocked registrations, recovery items, and risky sessions.

Weekly access review Inspect admin, agent, app, and temporary-role assignments.

Incident packet Collect evidence for break-glass, recovery, domain, or provider-binding incidents.

existing tools