Audit logging and metrics for security automation decisions.

Automation needs evidence, not just execution.

Security automation becomes hard to trust if teams cannot explain what happened, why a decision was made, what action was taken, and whether the action succeeded. The goal was to design an audit model that makes automation decisions reviewable.

Capture every important decision point.

• Recorded finding identifiers, resource IDs, account context, and control metadata.
• Tracked decision outcome: remediate, notify, skip, fail, or manual review.
• Captured exception state, ownership context, and failure reason.
• Stored action timestamps, status, and remediation result.
• Supported reporting metrics for recurring findings and automation performance.

A compact schema for repeatable evidence.

automation_audit(
  finding_id,
  cloud_account,
  resource_id,
  control_name,
  decision,
  action_taken,
  status,
  exception_state,
  failure_reason,
  created_at
)