---
id: capability.audit.event-retain
name: Audit Event Retention
summary: Collect, normalize, retain, and search audit events with integrity evidence across tenants.
owner: audit-core
status: production
domain: infotech
tags: [audit, retention, compliance]
joins:
  itc_cap: operations.audit
  provision: data/capability/audit-core-operational.json
  provision_maturity: D4

external_evidence:
  completeness:
    level: C3
    name: Substantial
    confidence: medium
    basis: live_receiver_and_restore_walk
    satisfied_expectations:
      - HTTP ingest through the backend contract
      - append-only Postgres custody on platform-pg
      - recovery cited to the live platform data.backup provision
    broken_expectations:
      - data.archive sink not provided
    out_of_scope_expectations:
      - application business audit semantics ownership
      - booked-cost origination
  reliability:
    level: R2
    confidence: medium
    basis: failure_matrix_and_restore_walk
    known_reliability_risks:
      - single replica

discovery:
  intent: >
    Provide independent audit fabric for collecting, retaining, searching, and
    proving integrity of audit events.
  includes:
    - audit ingestion
    - retention policy
    - search and export
    - tamper evidence
  excludes:
    - generating domain business events
    - procuring or operating platform backup
    - booked financial facts
  use_cases: []

availability:
  current_level: A4
  target_level: A5
  current_artifacts:
    - audit-core/deploy/audit-core.yaml
    - audit-core/audit_core/postgres_backend.py
    - rapp-postgres/consumers/audit-core.yaml
  consumption_modes:
    - http ingest
    - source module

relations:
  depends_on: []
  related_to:
    - capability.activity.event-coordinate
    - capability.statehub.progress-log
  uses_provisions:
    - data.transactional (rapp-postgres/platform-pg)
    - data.backup (resource:platform:audit-storage, cited)
    - security.secrets (OpenBao / ESO)

consumer_guidance:
  recommended_for:
    - platform and application audit event delivery over POST /v1/events
  not_recommended_for:
    - treating this store as WORM archive
    - replacing application-level logging only
  known_limitations:
    - recoverable history is the 30-day platform backup window
    - no hash-chain or export API yet
---

# Audit Event Retention

Audit Core provides the operational custody layer for audit events.
ITC-CAP join: `operations.audit` at provision maturity D4
(`data/capability/audit-core-operational.json`). Maturity is not a
property of this abstract capability.