Audit Event Builder

Reliability

Fully deterministic and independent of the machine: the same facts give byte-identical envelopes and one identical digest, whatever the default locale, zone or charset, and whatever order your attributes arrived in. Normalisation is fixed rather than configurable, because a normalisation you could change would produce envelopes that no longer compare equal. One residual gap is worth stating plainly: refusing credential-shaped key names and values over 512 characters is not secret detection, so a token hidden under an innocuous key such as note will pass — run security.detect_secrets over your attribute values first if that matters. Refusals, and what to do about each. GOV_AUDIT_INPUT_TOO_LARGE means the declared request is past the 65,536-byte inline limit, so trim the attributes. GOV_AUDIT_EVENT_INVALID means the event block is the wrong shape or an attribute value is not a string, integer or boolean, and the message names the path to correct. GOV_AUDIT_ACTOR_INVALID means the actor id is missing for a named actor type, present for ANONYMOUS, or outside [A-Za-z0-9._:@-], so fix the pair together. GOV_AUDIT_RESOURCE_INVALID means the resource type or id is empty or outside the identifier charset, so correct it. GOV_AUDIT_ACTION_INVALID means the action was empty once trimmed, so send what was actually done. GOV_AUDIT_OCCURRED_AT_MISSING means the field arrived empty or whitespace-only, and we invent no timestamp, so supply the instant. GOV_AUDIT_OCCURRED_AT_INVALID means it carries no explicit offset or is not parseable, and a local time is never assumed to be UTC, so add the offset. GOV_AUDIT_OUTCOME_UNSUPPORTED means the outcome is not one of the five, so map yours onto one of them. GOV_AUDIT_SEVERITY_UNSUPPORTED means the severity is not one of the five syslog names, so pick the closest. GOV_AUDIT_ACTOR_TYPE_UNSUPPORTED means the actor type is not one of the five, so choose one rather than inventing a label. GOV_AUDIT_FIELD_UNKNOWN means a property we do not declare turned up, which is exactly how an authorization header would try to get in, so delete it. GOV_AUDIT_FIELD_TOO_LONG means a vocabulary field went past 128 characters, an identifier past 256, or the correlation id past 128, so shorten it. GOV_AUDIT_VOCABULARY_INVALID means a vocabulary field or attribute key holds a character outside [a-z0-9_.] once lowercased, so use dots and underscores rather than spaces or slashes. GOV_AUDIT_CONTROL_CHARACTER means a control character or unpaired surrogate arrived, and we refuse rather than strip it, because a silently altered actor id is worse than a rejected request. GOV_AUDIT_FORBIDDEN_FIELD means an attribute key is one of the twenty naming a credential, cookie, token, session or raw body, so leave that value out of the audit record entirely. GOV_AUDIT_ATTRIBUTE_LIMIT_EXCEEDED means more than 32 attributes arrived, so keep the ones an auditor will actually read. GOV_AUDIT_ATTRIBUTE_TOO_LARGE means an attribute value went past 512 characters, which is also the check that catches a request body arriving as a long string, so summarise it or drop it. GOV_AUDIT_CORRELATION_ID_INVALID means the value carries whitespace or fits none of the three accepted shapes, and we refuse rather than drop it — call security.generate_uuid if you need one made. GOV_AUDIT_WORK_REFUSED means the projected normalisation operations went past 128, and the refusal reports both the projection and the budget, so send fewer attributes.