Let important changes leave their own evidence
High-impact resource changes produce an audit event through the shared operation path. Wildo records the action, its subject and the fields changed, so evidence follows the operation instead of depending on a separate logging call in every handler.
Example — Let important changes leave evidence
An administrator changes a member’s roles. The operation records which member changed, who acted and the marked role values before and after the change.
For engineers
HIGH and CRITICAL write variants meet the automatic audit floor. A lower-risk write can opt in with auditableEvent.auditBelowRiskFloor. Risk is an audit and interaction signal; roles and step-up authentication remain separate declarations.
The actual API-key creation variant combines its administrative gate, risk and one-time response contract:
Selected source from api-keys-organization.shared.resources-config.schemas.ts:
variantType: ResourceOperationVariantType.API_CALL,
isDefault: true,
roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys
riskLevel: ResourceOperationRiskLevel.HIGH,
// requestDto auto-derived from decorators
customResponseDto: ApiKeyOrganizationSchema.extend({
plainKey: z.string().min(1).isEphemeral()
}),
This selected variant lives inside the API-key resource’s CREATE operation. When the resource service completes persistence, its post-commit lane calls emitResourceOperationAudit. Custom operations reach the same mechanism through their declared operation path.
Choose which values the trail retains
The shared API-key schema marks authority explicitly:
roles: z.array(RolesSchema).default([]).isAuditEvidence(),
The changedFields list identifies submitted field names, including a value submitted unchanged; it is not a before/after diff. Only marked evidence fields contribute retained values. Choose authority and lifecycle fields deliberately; marking an entire object can retain every nested value it contains.
Single-record changes have a before-image; bulk changes do not promise a per-row prior value. A created record has no prior state. A custom response that reshapes the result still uses the fetched subject as the identity fallback.
Read-shaped operations do not emit this generic performed event, regardless of risk. One-time response disclosure is a separate mechanism for backend-only fields returned at creation and ephemeral response fields. .isAuditEvidence() selects write-evidence values; ordinary business reads need an appropriate explicit audit event when their access must be recorded. A purpose-built business event may coexist with the generic operation event: one explains the business fact, the other preserves the operation, roles and execution context.