## Design a Compliance Audit Log Platform Design a new audit-log subsystem for a multi-service legal product. Product services must record meaningful actions such as document access, messages sent to agents, and document edits. Law-firm administrators need an audit view that they can use for their own internal compliance work. ### Constraints & Assumptions - Events come from several independently deployed services. - One customer must never be able to read another customer's audit events. - Producers can retry, fail, or deliver events out of order. - The audit view must support filtering and investigation without changing the historical record. - Do not assume an event rate, retention period, or freshness target; identify the values that would change your design. ### Clarifying Questions to Ask - Which actions and outcomes must be recorded, and which fields are sensitive? - Does an administrator need strict chronological order, or is a stable per-resource or per-request order sufficient? - How quickly must an event become visible, and how long must it remain queryable? - Are corrections represented as new events, and who is permitted to export audit data? ### Part 1 — Define Events and the Ingestion Contract Specify a canonical event envelope and show how document access, an agent message, and a document edit fit it. Explain how services publish events without allowing an audit outage to corrupt the product action being recorded. #### What This Part Should Cover - Tenant, actor, action, resource, outcome, event time, ingestion time, and correlation identifiers. - Schema evolution and validation at the ingestion boundary. - Idempotency for producer retries and an explicit delivery guarantee. - A decision about synchronous versus asynchronous acknowledgement for compliance-sensitive actions. ```hint Separate the fact from its delivery Treat the business action and the transport attempt as different records so a retry does not become a second user action. ``` ### Part 2 — Store and Query the Audit History Design the write path, durable storage, indexing, and administrator-facing query path. Include filters useful for investigating activity across documents, users, action types, and time ranges. #### What This Part Should Cover - An append-oriented source of truth and a query-optimized projection. - Tenant-scoped authorization on every read and export path. - Pagination with a stable cursor when events share timestamps or arrive late. - Retention, archival, and index choices tied to stated workload assumptions. ```hint Give ordering a tie-breaker An event timestamp alone cannot produce stable pagination when clocks differ or multiple actions occur at once. ``` ### Part 3 — Make the Record Trustworthy and Operable Explain failure recovery, replay, monitoring, and controls that make the audit history useful during a compliance investigation. Address sensitive payloads without silently deleting evidence. #### What This Part Should Cover - Backpressure, dead-letter handling, replay, and projection rebuilds. - Detection of missing, duplicated, delayed, or malformed events. - Append-only corrections, privileged access logging, and tamper-evidence options. - Redaction or tokenization that preserves the meaning of an action while limiting sensitive content. ```hint Audit the audit system Identify which administrative reads, exports, corrections, and retention actions must themselves leave evidence. ``` ### What a Strong Answer Covers - A trace from a product action through durable ingestion to a tenant-authorized audit view. - Clear semantics for retries, ordering, late events, schema changes, and corrections. - Storage and indexing decisions connected to volume, retention, and query assumptions. - Concrete operational signals that reveal gaps before an administrator discovers them. ### Follow-up Questions 1. How would you prove that a document edit succeeded even if the event pipeline was temporarily unavailable? 2. How would you rebuild a corrupted search projection without rewriting the historical log? 3. What cursor would you use when two events have the same event time and a late event arrives between pages? 4. How would you support a legal hold that outlives the customer's default retention period?