---
id: ADR-PFM-OPS-007
title: 'Record activity is an append-only, workspace-isolated store separate from the security history'
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Store record activity separately from security history, with workspace isolation and insert/read privileges
  for the application role.
constrains:
  - DOM-PFM-OPS-002
  - SVC-PFM-OPS-audit
  - WF-PFM-OPS-008
  - WF-PFM-OPS-009
origin: >-
  services-platform:docs/audit-events.md#2026-10-12 — Final acceptance (accepted by Andrew);
  docs/row-level-security.md
alternatives:
  - option: Combine activity and security history
    why_not: Navigation traffic would obscure security decisions and mix their retention concerns.
  - option: Maintain a separate trail in every module
    why_not: 'Every owner would have to reproduce isolation, history queries and purge behavior.'
consequences:
  - Workspace purge removes events through the protected deletion function.
  - 'Retention remains undecided, so ordinary navigation can grow the store indefinitely.'
  - Mutation atomicity depends on the owning caller’s transaction.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/audit/db/audit-events.table.ts,
    services/persistence/audit-events.ts; docs/audit-events.md (Two tables, Append-only, Tenant deletion,
    Retention).
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# Record activity is an append-only, workspace-isolated store separate from the security history

## Context

Record navigation and business changes need a common activity account without crowding security decisions.

## Decision

Use one shared activity table with declared event types and bounded metadata. Restrict ordinary application privileges to inserting and reading within the selected workspace.

## Alternatives Considered

Combining trails would mix purposes. Separate stores would duplicate protection and history machinery.

## Consequences

Database privileges protect existing rows from ordinary application changes, while retention still needs a product decision.