Events, traces and audit logs

#Events: the outbox

When something happens in one service that another needs to know (an order is placed, so inventory must turn a reservation into a sale), the first service publishes an event.

Events carry ids and amounts, never personal data. A receiver that needs details asks the owning service for them, with permission checks.

#Traces

Every action a person takes (opening a page, saving a product) is a trace. Every hop that served it (the dashboard, each service, any service that one called) sends one span: the route template, method, status, timing, who, which organization, and which records and field names were touched. Never a value. Members with logs:read see their organization's traces under Organization → Logs.

#Audit logs

Each service keeps its own append-only, hash-chained audit log. Every entry includes a hash of the previous one, so removing or editing an entry breaks the chain, and the chains are verified. Audit entries record ids and field names, never values. Staff can read every chain from the admin console; each staff read is itself audited.