# Audit Logging

> Ensure every critical action is logged (vital for UAG/Trust Room).

- Skill: `majiayu000/audit-logging-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/audit-logging-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/audit-logging-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/audit-logging-2

---


# Audit Logging Protocol

## 1. Principles

- **No Invisible Actions**: Every state-changing API call (POST, PUT, DELETE) must produce a log entry.
- **Traceability**: Logs must include `userId`, `action`, `resourceId`, and `metadata`.

## 2. Implementation Standards

- **Backend (API)**:
  - Use the project's standard Logger service (e.g., `src/services/logger.ts` or similar).
  - Example:
    ```typescript
    await Logger.info({
      event: 'POST_CREATED',
      userId: user.id,
      metadata: { postId: newPost.id },
    });
    ```
- **Database (Supabase)**:
  - Ensure tables have `created_at`, `updated_at`, and `created_by` columns.
  - Check if specific Audit Table inserts are required (e.g. `audit_logs` table).

## 3. Verification Checklist

- [ ] Does the new API endpoint call `Logger`?
- [ ] Are logs visible in Supabase/Dashboards?
- [ ] Is the log level appropriate (Info vs Error)?
- [ ] Does the log contain enough context to debug issues later?