---
id: SVC-PFM-OPS-audit
title: Record Activity
product_area: platform
module: operations
repository: services-platform
source_module: modules/audit
revision: 1
status: draft
design_intent: confirmed
origin: 'services-platform:docs/audit-events.md#2026-10-12 — Final acceptance (accepted by Andrew)'
implementation_evidence: observed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
owns:
  - DOM-PFM-OPS-002
does_not_own:
  - 'Security retains the account of identity, authority and staff decisions.'
  - Queries owns record-based Recently Viewed answers.
  - >-
    Event publishers own the business meaning of their merge, intervention, eligibility, custom-record and
    attention activity.
inference: []
operations:
  - operation_id: getAuditHealth
    intent: Return technical build health for the activity function.
    access: public
    permission: none
    realises: []
    published_to_submissions: 'not published: a technical health route'
  - operation_id: recordRecordView
    intent: 'Record a registered readable target as one attributed visit occurrence, or return its duplicate.'
    access: console
    permission: 'platform.record-views.create, and the record type’s read and dataset-query keys evaluated for the target'
    realises:
      - CAP-PFM-OPS-008
      - CAP-PFM-OPS-010
    published_to_submissions: 'not published: navigation telemetry reported by the console, not a capture'
  - operation_id: listMyRecordViews
    intent: Return newest-first visits for the caller in the current workspace.
    access: console
    permission: platform.record-views.read
    realises:
      - CAP-PFM-OPS-009
    published_to_submissions: 'not published: a read that captures no business data'
  - operation_id: listUserRecordViews
    intent: >-
      Return newest-first visits for a named person in the current workspace under administrative audit
      authority.
    access: console
    permission: platform.audit-events.read
    realises:
      - CAP-PFM-OPS-009
    published_to_submissions: 'not published: a read that captures no business data'
events: []
jobs: []
integrations:
  - system: >-
      Platform modules writing mutation events (record merge, eligibility, custom records, attention; Commerce
      through a Platform function)
    direction: inbound
    contract: Caller-provided transaction context lets supported activity writers commit beside their business change.
  - system: Query layer
    direction: outbound
    contract: The query-reader role can select events within the selected workspace to build recent-record scopes.
  - system: Record datasets of CRM and Committees
    direction: outbound
    contract: Resolve the visit target through its owning dataset using current read and query authority.
consistency:
  - rule: >-
      Target resolution precedes the event insertion transaction; duplicate visits resolve the target again
      before returning the original occurrence.
    kind: transactional
    compensation: Occurrence uniqueness prevents a second same-key event.
  - rule: >-
      Mutation activity commits with a business change when its owner invokes the writer in the same
      transaction.
    kind: transactional
    compensation: 'Without a caller transaction, the writer has no business-change rollback to share.'
  - rule: A console visit may be lost after delivery retries are exhausted.
    kind: eventual
    compensation: No delivery repair path is declared.
evidence:
  - >-
    services-platform at ad3f6a6: modules/audit/aws/api/audit.routes.ts, audit-api-mapper.ts,
    record-views.schemas.ts; services/*; db/audit-events.table.ts; registry/viewable-record-types.ts;
    aws/platform.service.ts (RECORD_VIEWS_PERMISSIONS, AUDIT_EVENTS_PERMISSIONS); docs/audit-events.md.
  - 'react-console at baf6dae: lib/api/audit.ts; lib/record-views/tracking.'
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Record Activity

## What This Service Is For

Record Activity retains visits and supported business activity within each workspace. It lets people inspect their own navigation history and lets authorized administrators inspect another person’s visits.

## Boundary

Audit owns the shared activity store and writer functions. Security maintains a separate security history. Queries uses the activity account to find current readable records, while each publisher defines the meaning of its business events.

## Operations in Words

Reporting requires an occurrence key and a registered target. Current target read and dataset authority are resolved before insertion; a repeated same-target key returns the old event, and changed-target reuse causes conflict.

Personal history and administrative history use distinct permissions. They return visit events only, newest first, with twenty-five rows by default and a maximum of fifty. Every operation states why it is unpublished to Submissions.

## Events and Jobs

No business-event transport or job is declared here. Other modules use in-process activity writers, and workspace deletion invokes bounded activity purge.

## Consistency Guarantees

Workspace policies and ordinary application privileges protect stored events. Event insertion is transactional, but target resolution happens first. Mutation atomicity requires the owner’s transaction. Client delivery can lose visits, and retention beyond workspace removal still lacks a decision.