Observe
Immutable audit history
Auditable events are appended to a log that is never rewritten in place. Each entry carries the event, the resource it touched, the recorded payload, the email of whoever caused it, and when it happened.
Two records, kept apart
A project-wide log answers "what happened here," and a per-record history answers "what did this value do." They are queried separately because the questions arrive separately.
Project audit log
Every auditable event, across every resource type.
- Event type, resource type, and resource id
- The event payload as it was recorded
- Author email and a correlation id
- Filter by free text, event type, resource type, resource id, author, and a start and end window
Entity field history
What a single record's values did over time.
- Previous value and new value for each change
- Dimension, list, and reference attributes
- Filter by attribute, date window, author, or matched value
- Sort by time, attribute, or value, with pagination
Field-level detail
A change to a dimension, list, or reference attribute records the attribute, the value before, the value after, the timestamp, and the author.
Metrics stay out of it
High-frequency metric observations are written to time-series storage and skip this log. A sensor reporting every five minutes would otherwise bury the handful of entries a person actually needs to read, so the two are kept on separate paths and queried through separate endpoints.
Real timestamps when you migrate
Importing history from an older system usually stamps every row with the moment of the import, which collapses years of activity into one afternoon.
Each attribute value in a create or update payload accepts
its own updated_at timestamp, in ISO 8601 or YYYY-MM-DD HH:MM:SS. Supply the time the change actually happened and the
history reads in the order events occurred.
What the log is for
Reconstructing the sequence during an incident review. Answering who moved a threshold, and when. Showing an auditor the change trail behind a record under a retention obligation. The log records what the system observed; the judgement about whether that satisfies a given standard stays with you and your auditor.
Audit-Ready Architecture: SOC 2 & ISO 27001 Evidence
Omnismith provides an Audit-Ready Architecture built to satisfy internal IT asset inventory, ISO 27001, and SOC 2 Trust Services Criteria evidence requirements without claiming third-party vendor certification on behalf of your company.
Cryptographic Author Attribution
Every write operation is immutably stamped with an authenticated identity, correlation ID, and microsecond timestamp. Auditors inspect tamper-evident before/after diffs for change management controls.
Granular RBAC & Access Scopes
Enforce least-privilege policies across project domains, resource templates, and row-level access scopes. System access and role reassignments are captured permanently in the project ledger.
Built-in immutable change logs with cryptographic author attribution, role-based access control (RBAC), and time-series telemetry designed to satisfy internal IT asset inventory, ISO 27001, and SOC 2 evidence requirements.