Skip to content

📘 Scope & Boundaries of the Audit Trail Platform

Defining what the Audit Trail Platform (ATP) owns, delivers, and governs within the ConnectSoft SaaS ecosystem — across functional, architectural, and compliance domains.

Overview

The Audit Trail Platform (ATP) is a core cross-cutting service inside the ConnectSoft SaaS architecture.
It operates as the system of record for all actions and events that must be provable, immutable, and compliant across multi-tenant environments.

ATP’s mandate is to guarantee auditability as a service — capturing every meaningful operation from any ConnectSoft microservice, preserving it under strict retention and residency rules, and making it securely accessible for verification, export, and compliance review.

While it integrates deeply with existing observability, messaging, and identity systems, ATP has a clearly defined and limited scope focused on trustworthy evidence, not operational telemetry.

Functional Scope

The platform’s functional responsibilities cover the complete lifecycle of an audit record:

Area Responsibility Description
Ingestion Receive, validate, and normalize audit records. Accept events from producers through SDKs or API Gateway; apply schema and actor validation.
Persistence Store immutable audit data in write-once, read-many (WORM) repositories. Ensure durability and tamper evidence using chained digital signatures.
Query & Retrieval Provide multi-tenant APIs to fetch and filter audit history. Offer REST/gRPC endpoints, indexed search, and query projections.
Retention & Residency Apply tenant-specific data lifecycle policies. Execute retention periods, legal holds, and regional residency constraints.
Export & eDiscovery Facilitate compliant data extraction and signed evidence bundles. Generate downloadable packages or webhook-delivered artifacts.
Integrity & Redaction Guarantee verifiability and protect sensitive information. Implement rolling hash chains and classification-based redaction.

Each capability is delivered as a bounded microservice, ensuring clear separation of responsibilities and scalability per domain.

Architectural Scope

ATP consists of multiple collaborating services, organized into bounded contexts that follow Domain-Driven Design principles:

Bounded Context Responsibility Key Services
Ingestion Context Validate incoming events and transform to canonical schema. Audit.IngestionService
Storage Context Persist and partition records per tenant and jurisdiction. Audit.StorageService
Integrity Context Maintain cryptographic proofs and hash chains. Audit.IntegrityService
Policy Context Evaluate retention, residency, and legal hold rules. Audit.PolicyService
Export Context Manage export jobs, evidence manifests, and signed delivery. Audit.ExportService

Platform Integrations

  • Identity & Access Control — OAuth2/OpenID Connect via ConnectSoft Identity Server.
  • Messaging Bus — MassTransit over Azure Service Bus for event propagation.
  • Observability — OpenTelemetry traces, Prometheus metrics, Grafana dashboards.
  • Configuration — ConnectSoft ECS for runtime policy and feature toggles.

Together, these integrations make ATP a first-class participant in the ConnectSoft SaaS fabric while maintaining strict data ownership boundaries.

Compliance Scope

ATP is built to satisfy the compliance and auditability needs of enterprise tenants and regulatory frameworks:

  • Regulatory Alignment: Designed to meet SOC 2, GDPR, HIPAA, and ISO 27001 requirements for traceability and retention.
  • Tenant Isolation: Every record is partitioned per tenant, ensuring confidentiality and jurisdiction-specific governance.
  • Residency Enforcement: Data residency policies ensure audit data remains within approved geographic regions.
  • Policy Auditability: Every retention or redaction action emits a signed ComplianceEvent, ensuring that compliance actions are themselves auditable.
  • Evidence Readiness: Export artifacts and verification manifests are legally defensible, cryptographically signed, and immutable.

Out-of-Scope (Preview)

Certain areas intentionally fall outside ATP’s domain and are detailed in Non-Goals & Exclusions.
In short, ATP does not replace the observability stack, SIEM solutions, or general data-analytics platforms — its sole purpose is to provide compliance-grade audit evidence.

Boundaries, Interfaces & Integrations

The Audit Trail Platform (ATP) sits at the intersection of multiple ConnectSoft platform services.
It must balance clear ownership of the audit domain with seamless integration across identity, configuration, and observability layers.
This section defines where ATP stops and other systems begin.

Internal vs External Boundaries

ATP owns the complete lifecycle of an audit record from ingestion to export but delegates related cross-cutting functions to existing platform services.

Category Description Examples
Owned Services Internal microservices prefixed with Audit.* that form ATP’s bounded contexts. Audit.IngestionService, Audit.StorageService, Audit.PolicyService, Audit.IntegrityService, Audit.ExportService, Audit.ComplianceService
Consuming Systems External systems that either produce or consume audit data through standard contracts. ConnectSoft Identity Server, ConnectSoft ECS (Configuration Service), ConnectSoft Notifications Service
Supporting Infrastructure Shared runtime foundations used by all ConnectSoft microservices. Azure Service Bus, Azure SQL / PostgreSQL, Blob Archive, Kubernetes Cluster Infrastructure

ATP’s microservices are autonomous, but every integration follows a defined anti-corruption layer that enforces contract stability and compliance traceability.

Integration Points

Interface Purpose Technology
Message Bus Primary asynchronous channel for AuditRecordAppended, PolicyApplied, and ExportCompleted events. MassTransit over Azure Service Bus (Topics & Subscriptions)
API Gateway Entry point for SDKs and external consumers; provides authentication, throttling, and version routing. ConnectSoft API Gateway (Service Mesh Ingress + Ocelot Policies)
Webhooks Signed push notifications for retention actions, export completion, or integrity alerts. HTTPS callbacks with HMAC-SHA256 signatures
SDKs Developer libraries to publish or query audit data safely. ConnectSoft.AuditTrail.Client (C#), ConnectSoft.AuditTrail.SDK (JS/TS)
Query API Read-side endpoints for eDiscovery, investigation, and internal dashboards. REST / gRPC contracts under api/audit/v1

Each integration is versioned and validated through contract tests during CI/CD pipelines, ensuring safe evolution without breaking consumers.

Shared Concerns

ATP inherits several cross-platform capabilities from the ConnectSoft foundation:

  • Authentication / Authorization — all endpoints secured via OAuth 2.0 / OpenID Connect tokens issued by ConnectSoft Identity Server.
  • Observability — every service emits OpenTelemetry traces, structured logs, and Prometheus metrics aggregated in Grafana dashboards.
  • Compliance Evidence Chain — the Audit.ComplianceService maintains its own ledger of compliance actions, proving that policies, exports, and retention runs were executed as declared.

These shared layers provide unified visibility and governance without duplicating platform concerns.

Outbox / Inbox Pattern Scope

ATP leverages the Outbox Pattern for reliable audit event propagation:

  • Producer Microservices
    • Any business service in the ConnectSoft ecosystem (e.g., Booking, Billing, Membership).
    • Writes AuditRecord to its local outbox table within the same transaction as the domain change.
  • ATP Consumers
    • Audit.IngestionService subscribes to outbox events via Azure Service Bus, ensuring at-least-once delivery.
    • Audit.QueryService and Audit.PolicyService use inbox patterns for idempotent processing and state updates.

This separation allows each producing system to remain loosely coupled, guaranteeing that audit events are never lost or replayed incorrectly.

Cross-Cutting Boundaries

Domain Responsibility Provider
Configuration Management Centralized feature flags and policy definitions. ConnectSoft.ECS
Security Posture Workload identity, certificate rotation, and Zero-Trust enforcement. SPIFFE / SPIRE integration
Observability and Telemetry Distributed tracing, metrics, log aggregation. ConnectSoft.Observability
Infrastructure Compliance Container scanning, image signing, vulnerability management. ConnectSoft.SupplyChain & Security Ops

These integrations ensure ATP operates within the same governance and security perimeter as all ConnectSoft core services.

System Boundary Diagram

graph LR
Producer["Producer Microservices"] -->|AuditRecord| Ingestion["Audit.IngestionService"]
Ingestion --> Storage["Audit.StorageService"]
Storage --> Query["Audit.QueryService"]
Query --> Export["Audit.ExportService"]
Query --> Compliance["Audit.ComplianceService"]
Identity["ConnectSoft.Identity Server"] --> Gateway["API Gateway"]
ECS["ConnectSoft.ECS"] --> Policy["Audit.PolicyService"]
Observability["ConnectSoft.Observability"] --> Compliance
Hold "Alt" / "Option" to enable pan & zoom

This diagram shows how internal ATP services interact with external systems while maintaining strict separation of concerns and responsibility boundaries.

Non-Goals & Exclusions

While the Audit Trail Platform (ATP) delivers critical auditability and compliance capabilities, it deliberately avoids over-expansion into neighboring domains.
Defining what ATP does not do is essential to maintain focus, maintainability, and architectural integrity across the ConnectSoft SaaS ecosystem.

Purpose of Non-Goals

Establishing clear non-goals prevents duplication of effort and ensures each ConnectSoft subsystem retains single ownership of its domain.
These boundaries protect ATP from scope creep, allowing it to remain a compliance-grade audit service rather than an all-purpose observability or analytics platform.

By codifying exclusions, teams can integrate confidently — knowing what capabilities ATP provides and where responsibilities shift to other platform services.

Functional Non-Goals

ATP’s function is to record and preserve immutable audit evidence — not to operate as a monitoring, logging, or analytics stack.

  • ❌ No Observability Replacement — ATP does not replace logs, metrics, or traces. These remain under ConnectSoft.Observability.
  • ❌ No SIEM or Real-Time Monitoring — ATP is optimized for evidence retention and forensic replay, not streaming alert correlation or threat detection.
  • ❌ No General Analytics or ETL — ATP provides structured exports for compliance, but it is not a data-lake or ETL pipeline for arbitrary analysis.
  • ❌ No User Activity Dashboards — Any analytical visualization layer (e.g., dashboards, heatmaps) belongs to the analytics platform, not ATP.

Operational Non-Goals

ATP focuses exclusively on the audit domain; it does not govern or replicate business, identity, or runtime management functions.

  • ❌ No Business Data Hosting — ATP never stores operational or transactional data unrelated to audit evidence.
  • ❌ No Tenant Identity or Billing Control — Authentication, authorization, and billing remain under ConnectSoft.Identity and ConnectSoft.Billing.
  • ❌ No Incident Response Orchestration — Alert routing, escalation, and paging are handled by ConnectSoft.SRE.
  • ❌ No System Configuration Management — Application settings, feature flags, and rollout rules are owned by ConnectSoft.ECS.

Compliance Non-Goals

ATP is a compliance-enabling system, not a compliance-interpreting one.

  • ❌ No Legal Interpretation — ATP enforces retention and redaction but does not define regulatory meaning or thresholds (e.g., “PII,” “sensitive data”).
  • ❌ No Policy Negotiation — Decisions about what constitutes lawful retention duration or residency jurisdiction are governed by the Governance & Compliance Office.
  • ❌ No External Audit Replacement — ATP supplies data for audits but does not perform them or certify compliance status.

These exclusions ensure separation of duties between engineering implementation and corporate compliance governance.

Rationale

The deliberate scoping of ATP ensures:

  • Reliability — fewer moving parts lead to predictable behavior and easier verification.
  • Audit Integrity — avoiding entanglement with unrelated domains preserves chain-of-custody guarantees.
  • Platform Modularity — each ConnectSoft subsystem can evolve independently while sharing standardized contracts.
  • Compliance Assurance — by staying focused, ATP remains certifiable under SOC 2 controls for evidence management.

Summary of Exclusions

Area Excluded Function Owner / System
Observability Log / trace aggregation ConnectSoft.Observability
Identity Authentication & SSO ConnectSoft.Identity
Configuration App settings / feature flags ConnectSoft.ECS
Incident Response Alert routing & on-call automation ConnectSoft.SRE
Billing & Finance Tenant billing logic ConnectSoft.Billing
Analytics Dashboards & reporting UI ConnectSoft.Analytics

By defining these boundaries, the Audit Trail Platform remains purpose-built — an immutable, verifiable evidence layer that integrates cleanly with the broader ConnectSoft SaaS ecosystem without overstepping its domain.