---
id: ADR-COM-ORD-014
title: Interventions are logged first; the audit event follows
product_area: commerce
module: orders
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Commit reasoned staff intervention records with the domain change, then attempt audit delivery without
  making audit availability a precondition.
constrains:
  - WF-COM-ORD-005
  - WF-COM-ORD-009
  - WF-COM-ORD-010
  - WF-COM-ORD-012
  - WF-COM-ORD-013
  - SVC-COM-ORD-orders
  - SVC-COM-ORD-entitlements
  - SCR-COM-ORD-002
origin: >-
  services-platform docs/proposals/commerce-orders/05-obligation-register-and-policies.md section 8 and
  Platform docs/audit-events.md, as cited by the code (FND-COM-ORD-048)
alternatives:
  - option: Require remote audit success before committing an intervention
    why_not: A remote audit outage would extend locks and stop the staff change.
  - option: Treat the local intervention record as the entire audit control
    why_not: The intended centralized audit control would remain unimplemented.
consequences:
  - Committed interventions retain their local accountability row.
  - 'Until a durable writer exists, Platform audit delivery remains incomplete.'
  - Fixed approval text records less explanation than a person-supplied reason.
supersedes: []
evidence:
  - >-
    services-commerce at c8b66a98: modules/fulfillment/services/register/intervention-audit.ts;
    persistence/intervention-logs.ts; modules/orders/services/orders/void-order.ts;
    modules/entitlements/services/entitlements/entitlement-interventions.ts.
---

# Interventions are logged first; the audit event follows

## Context

Sensitive staff changes need actor and reason evidence.

## Decision

Write local intervention accountability atomically, then attempt its audit message after commit.

## Alternatives Considered

Auditing inside the transaction could block interventions on a remote outage. Local logging alone leaves the intended Platform audit integration incomplete.

## Consequences

The local record survives audit failure. The default audit fixture and fixed console approval reasons remain control gaps.