Audit trail auto-documenter

A certifiable audit trail row names three things: the system event that proves the action happened, the actor who took it, and the statute clause that requires the agency to keep a record of it. If the event is not a decision, the row stays empty. The extract is a working file. A records officer still certifies.

Operational systems already log more than a records schedule needs. Status flips, comment threads, attachment uploads, and assignment hops fill activity feeds in case, permitting, and service platforms. Accountability statutes care about a narrower class: decisions that create, deny, condition, or close a right, benefit, enforcement action, or official position.

Treat vendor activity exports as a class of source events, not as the finished accountability record. Microsoft, ServiceNow, Salesforce Government Cloud, and Tyler each emit timestamps, user identifiers, and workflow states. Those feeds are useful because they are tied to live systems. They are not a certified trail until a records officer has accepted rows that cite event, actor, and clause, and has rejected rows that do not.

A trail that cannot be traced to a source event cannot be defended. A trail that names a person but not the legal basis for keeping the row is a diary, not a record. A trail that fills every log line with a statute citation inflates the series and makes certification meaningless.

Load two inputs before any row is written. The first is the operational event stream: identifiers, timestamps, actor accounts, object keys, and the raw payload or status transition. The second is the agency records schedule: series titles, the legal citations that authorize or require retention, and any mapping from business process to series.

Do not invent a retention year. If the schedule has no series for the process, or the series has no period, leave retention blank and flag the gap for the records officer. Guessing a period (seven years, ten years, "until superseded") creates a false legal position and can conflict with the schedule the agency has already filed.

Match events to the schedule by process, not by vendor module name. A permit decision in one platform and a benefit decision in another may land in different series even when both look like "approval" in the activity log. Where the decision will later feed a legislative compliance report assembler, keep the same event identifier so the report can point at the trail row rather than restating the facts.

When several agencies will later sign the same matter, keep the trail scoped to this agency's decision events. Cross-agency concurrence belongs in a multi-agency sign-off orchestrator, not as extra rows invented to look complete.

Work event by event. For each candidate, decide whether it is a decision. A decision changes an official position: grant, deny, issue, revoke, close, or set a binding condition. A comment, a reassignment, a draft save, or a notification is not a decision even if a person clicked it.

If it is a decision, write one row with:

• event identifier exactly as the source system stores it
• actor as the authenticated account on that event, not a display name guessed from a later comment
• statute or regulation clause that requires the record of that class of decision

If it is not a decision, leave the trail fields empty. Do not copy the log line into the trail "for completeness." Empty stays empty.

Illustrative path through one license file. A licensing officer in a state professional board system records an approval on application 18-4421. The source event is PERMIT_DECISION#88421, actor account j.reyes, payload status set to issued. The records schedule maps professional license issuances to the clause that requires the agency to keep a record of each license granted. The trail row cites PERMIT_DECISION#88421, j.reyes, and that clause. A prior event in the same case, a clerk attaching a transcript, is not a decision. That event produces no trail row. The officer later certifies the issuance row, not the attachment log.

If the same approval also generated conditions, the trail still cites the decision event. The wording of conditions is a separate work product; use a condition generator for approvals for that text. Do not merge condition language into the trail as if it were the legal basis for keeping the record.

When a later report has to explain why a figure moved, a variance explainer can point at the same event identifiers. The trail is the cite. The explainer is not a second audit log.

Failure mode: a row with no event ID. A sentence that says the officer approved the license on Tuesday, without PERMIT_DECISION#88421, cannot be reconciled to the system of record. If the extract cannot supply an identifier, do not write a row. Flag the event as unlinkable and stop. Inventing an ID is worse than an empty field.

Certification volume is a quality problem. If every login, view, and routing hop becomes a statute-cited row, the series is no longer a decision trail. Reviewers cannot see what was decided. The records officer is asked to certify noise.

Use a short test: would this event, standing alone, be the thing a statute required the agency to record? If the answer is no, do not fill the row. Routing a file to a reviewer is process. The reviewer's grant or denial is the decision. A system-generated reminder is not an actor decision even when it has a timestamp.

Where the source feed is mixed, produce a sparse trail and a separate working list of unmatched events rather than forcing a citation onto every line. The unmatched list is operational. It is not certified.

The auto-documenter produces a candidate file: rows that cite event, actor, and clause, plus empty slots and flags for unlinkable or unscheduled items. That file is not the official record until a records officer certifies it.

Failure mode: treating the extract as certified. Publishing it to a portal, attaching it to a filing, or handing it to counsel as the audit trail before certification creates a document the agency may not be able to stand behind. If a row is wrong, the extract still exists. Certification is the control that says these rows are the trail.

The officer's review is not a rubber stamp of the capture. Check that every filled row has an event identifier that resolves in the source system. Check that the actor is the account on that event. Check that the clause is the one on the schedule for that series, not a nearby-sounding provision. Check that empty rows were left empty rather than padded. Check that no retention period was invented where the schedule is silent.

After certification, freeze the cited event identifiers. Later operational edits in Microsoft, ServiceNow, Salesforce Government Cloud, or Tyler systems do not rewrite the certified row. If the source event is corrected, that is a new event and, if it is a decision, a new candidate row. The certified trail is not a live feed.

The quality bar is a trail a records officer can certify: system event, actor, statute clause; empty when there was no decision; no invented retention year.