The audit log: one JSON object per line, one file per day. It records what was asked, where, and how it ended — never file contents and never the text a guard rule matched.