The record a board, an auditor or an insurer will ask for.
Every state-changing action in Worklane writes an audit row — server actions, background jobs, webhooks and every move Lane makes. Not a "recent activity" feed that forgets; the real thing, with payloads.
What it does
The audit call is enforced at build time: a state-changing handler that writes no audit row fails the build. Coverage is a property of the codebase, not a policy people remember.
Who did it — including when the actor was Lane and on whose behalf — what changed, from what to what, and when. Filterable and exportable.
Isolation is enforced in the database, not by a WHERE clause somebody has to remember. Every tenant-scoped table carries the policy and the grant, checked in CI.
Export and erasure requests are handled as a real workflow with a record of what was produced and when, rather than a developer running a query.
Where a trade needs it — pastoral notes, medical flags, safeguarding records — visibility tiers are enforced in the engine rather than hidden in the interface. There is no "admin sees everything" branch.
Messaging consent, signed agreements, retention windows and residency settings are configuration with a history, not a page in a policy document.