R13.6: Audit event journaling

Short answer: Security-critical actions append an immutable audit record. Without an audit record you cannot say who changed a role or a key.

Group: Observability and logging. Status: stable. Generated from the rule definitions; do not edit by hand.

Playground: https://brevio.pro/tools/agent-guard-playground?rule=R13.6

What it catches

Audit event journaling: security-critical actions append an immutable audit record.

Why

Without an audit record you cannot say who changed a role or a key.

A bad example

await setRole(user, 'admin');

A good example

await setRole(user, 'admin');
await audit.append({ actor, action: 'role.set', target: user });

How it is checked

Nothing yet. No scanner and no slice card checks it: it is a standing rule for authors and reviewers.

How to silence it

A person can silence one finding with brevio-core: ignore R13.6 -- reason on the line or the line above. Without the reason it does not count. An agent cannot silence it: the agent hook and the MCP tools never honour the comment, and a pull request that adds one is reported until a reviewer allows it. Fixing the code is still the better answer.

To change what the rule flags, edit its definition in dev_rules.py or code_rules/__init__.py. That is a code change and is reviewed like one.

R13.7 Health check hermeticity
R13.8 Exception traceback containment
R13.1 Zero secret logging
R13.2 Structured JSON logging
Every rule