---
id: ADR-PFM-SEC-014
title: Dedicated security history and refusal recording
product_area: platform
module: security
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Retain the observed append-only writer interface and post-rollback refusal recording, while treating
  general database immutability and credential-payload rejection as unproved and allowing authorized scoped-history
  purge.
constrains:
- DOM-PFM-SEC-003
- SVC-PFM-SEC-security
- SCR-PFM-SEC-003
- SCR-PFM-SEC-007
- SCR-PFM-SEC-011
origin: services-platform:docs/security/security-administration.md#5 (refused attempts); authorization revision
  2 §8.6, §14.2
alternatives:
- option: Use ordinary database record history for all security explanation.
  why_not: Row history does not supply refused attempts, sign-in context, delegation classification or affected-holder
    summaries.
consequences:
- Refusal recording uses a separate transaction after rollback, which has its own possible write failure.
- Workspace-scoped security events are purged under the current retention default while deletion requests retain
  their staff decision record.
- Retirement recovery still lacks a dedicated security event.
- The event writer accepts raw before/after values; no general credential-rejection filter is established by
  this path.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Dedicated security history and refusal recording

## Context

The dedicated trail explains security decisions beyond ordinary row history. It avoids credential material and attributes successful changes within their transaction.

Retention and missing recovery events remain product/implementation findings. A separately attempted refusal record is not a guarantee that every refusal was durably recorded.

## Decision

Retain the observed append-only writer interface and post-rollback refusal recording, while treating general database immutability and credential-payload rejection as unproved and allowing authorized scoped-history purge.

## Alternatives Considered

Use ordinary database record history for all security explanation. Row history does not supply refused attempts, sign-in context, delegation classification or affected-holder summaries.

## Consequences

Refusal recording uses a separate transaction after rollback, which has its own possible write failure.

Workspace-scoped security events are purged under the current retention default while deletion requests retain their staff decision record.

Retirement recovery still lacks a dedicated security event.