Actor
Know whether the event came from a staff principal, machine principal or external recipient.
Auditability
When someone asks “who opened it?”, the product should know.
Audit works best when it is part of the product model, so a question can be answered directly from the product record instead of reconstructed later from multiple systems. Casewelt keeps content and security events in a queryable organisational record so important questions can be answered from the system that made the decision.
Product evidence
Organisation-scoped events, with a hash-chain tip.
The live organisation-admin Audit surface lists When, Who, Action, Outcome and Resource. Who uses the stored login name when membership has it. Event hashes stay off this screen. Checkpoints remain append-only.
Downstream SIEM delivery can extend visibility, but the product record remains the place to answer product questions directly.
Evidence with context
Record more than “something happened”.
Object
Connect the event to the relevant workspace object, file version, share or policy context.
Outcome
Distinguish successful access, explicit policy denial, expiry and revocation-related failures.
Sequence
Keep enough ordering context to reconstruct how the state changed over time.
Delivery
Send selected events to downstream systems through signed webhooks without making the copy the source of truth.
Operations
Treat duplicate webhook deliveries as a normal at-least-once pattern that consumers can deduplicate.
Operational value
Audit should help during normal operations as well as after an incident.
Security teams need evidence, but so do support, compliance and product operations. A structured audit model helps distinguish a policy denial from a revoked session, an expired share from a missing file, or a user action from machine automation.
That clarity shortens investigations and makes integrations more reliable because downstream systems receive events with stable identity rather than prose assembled from logs.
Explore the developer surfaceStart with a question
Start with a question your audit team actually asks.
We can trace the actor, object, version, decision and sequence directly in the product model.