---
id: ADR-PFM-INT-010
title: History is the integration trail and the security trail
product_area: platform
module: integrations
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Record audited integration mutations in both the integration event trail and Security’s audit storage within
  the mutation transaction. This lifecycle-oriented history is distinct from field-level change capture.
constrains:
  - DOM-PFM-INT-001
  - DOM-PFM-INT-002
  - DOM-PFM-INT-003
  - DOM-PFM-INT-004
  - DOM-PFM-INT-005
  - SVC-PFM-INT-integrations
  - SVC-PFM-INT-extensions
alternatives:
  - option: Use field-level record change capture for all lifecycle history.
    why_not: 'Verification, rotation and binding changes are meaningful events rather than simple field differences.'
consequences:
  - A refused audited mutation retains its prior state and writes no successful-change history.
  - Registry registration remains unaudited and requires a separate decision.
  - Deletion purges protected integration history first through a privileged function.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a65: modules/integrations/db/integration-audit-events.table.ts;
    docs/record-history.md
---

# History is the integration trail and the security trail

## Context

This audit choice applies to integration mutations; extension and workflow storage have their own declared behavior.

## Decision

Record audited integration mutations in both the integration event trail and Security’s audit storage within the mutation transaction. This lifecycle-oriented history is distinct from field-level change capture.

## Alternatives Considered

Use field-level record change capture for all lifecycle history. Verification, rotation and binding changes are meaningful events rather than simple field differences.

## Consequences

A refused audited mutation retains its prior state and writes no successful-change history.

Registry registration remains unaudited and requires a separate decision.

Deletion purges protected integration history first through a privileged function.