Audit persistence follows the action owner

Context

Security events belong to the service performing the action. The content system and its API have separate commits, creating a documented exception to atomic auditing.

Decision

Websites owns its append-only security trail; confirmation, review and rollback commit their records with audit entries, editor issuance records before returning, and content actions audit afterwards.

Alternatives Considered

• Write to Platform's trail: No examined Platform route accepts audit writes from this service.
• Send events after commit: The control requires atomic auditing for the protected actions; content’s separate write remains a departure.

Consequences

• A successful content action can lack its audit entry if that later write fails.
• Displaying website actions in shared security history requires reading the Websites trail.