Auditing & Compliance

ASG produces an auditable enforcement record for every validation request.

What gets logged

For each validation, ASG logs:

• the decision outcome (PASS/WARN/BLOCK)
• risk score
• reason
• policy version (when applicable)
• applied rules / matched policy IDs (when applicable)
• timestamps

Approval comments

For WARN decisions, approval adds audit fields:

• approver identity
• approval timestamp
• approval comment (if provided)

Policy versioning

ASG records which managed policy version or configured rule set produced the decision.

Correlation IDs

You should provide correlation identifiers in context so decisions can be traced to:

• an external request
• a workflow run
• an internal ticket

Retention behavior

ASG stores decisions and approvals so you can:

• reconstruct why an action was allowed or blocked
• demonstrate human review when required
• support incident investigations