Struct AuditEvent 

pub struct AuditEvent {
    pub seq: u64,
    pub transaction_id: String,
    pub action_name: String,
    pub risk_level: RiskLevel,
    pub summary: String,
    pub approval_id: Option<String>,
    pub created_at: String,
    pub chain_hash: String,
    pub key_id: String,
    pub caller_role: Option<String>,
    pub caller_principal: Option<String>,
    pub final_status: Option<String>,
}

One audit event handed to the forwarder. Mirrors the chain content captured at INSERT time so SIEM rules can correlate by transaction_id and request_hash against the local hash-chained log.

final_status is None for the preview-time event (no terminal state yet) and Some for the execute-time event emitted after update_status. SOC analysts watching the SIEM can therefore tell from the same event stream whether an action ran, succeeded, failed, or was rolled back.

Fields

seq: u64

transaction_id: String

action_name: String

risk_level: RiskLevel

summary: String

approval_id: Option<String>

created_at: String

chain_hash: String

key_id: String

caller_role: Option<String>

caller_principal: Option<String>

Which account the daemon attributed the call to, taken from the signed row rather than from the connection state, so the SIEM sees what the chain says. None only for rows written before the principal existed.

Without this the whole point of the signed principal stops at the local database: a SOC watching this stream would still see only “an Admin did this”, and could not see an attribution failure at all.

final_status: Option<String>

Trait Implementations

impl Clone for AuditEvent

fn clone(&self) -> AuditEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.