Keep customer evidence in the right scope
An event’s subject and its delivery destination are different facts. Wildo keeps customer viewing and security-event delivery tied to the appropriate scope, so a customer identifier inside event data cannot choose where that event is sent.
Example — Keep customer evidence in its proper scope
An attempted sign-in names a customer domain. The event can retain that subject without allowing the submitted domain to choose a security-export destination.
For engineers
The central writer preserves the organization an event is about. Its tenant-delivery decision instead takes verified membership destinations or the originating authenticated organization:
const ecOrg = requestExecutionContext?.initiatorIds?.organizationId;
const routeToOrgs: string[] = routingOrgIds ?? (ecOrg ? [ecOrg] : []);
These are exact lines from _createAuditLog in audit-logs.backend.service.ts. The following dispatch iterates that resolved set, reading each destination in its own organization context. An empty set creates no tenant delivery. A disagreement between event data and authenticated scope does not let the data win.
Apply the boundary at each viewing door
The organization audit resource adds the authenticated organization filter. Its bounded export constructs the same scope without a body override. The application audit resource shares persistence but has separate super-administrator access and records cross-tenant reads; it is not a customer shortcut into another organization’s trail.
A targeted event can be visible to the organization it concerns even when it did not originate from an authenticated customer session. Viewing evidence about a subject and sending it to a configured endpoint remain distinct operations.
Keep application evidence available
Events without a tenant delivery route remain part of the primary trail and can reach configured application-level ledger providers. A customer’s security export is therefore the selected tenant stream, not a promise that it contains every event the application records.