Audit and Error Semantics

Every command carries request identity through the mutation path. Command-service audit records capture request ID, actor ID, mutation, target, outcome, and a safe reason code.

Audit output excludes API keys, authorization headers, property values, and process parameter values. These exclusions keep operational records useful without turning them into credential or experiment-value logs.

Server errors use stable error categories and request IDs. Clients can return a request ID with an error report without exposing internal exception details or authorization grant contents.

The command layer emits success records inside the mutation transaction and can write non-authorization failure records after rollback. The current REST server does not connect commands to a durable audit sink, so REST audit output is not persisted.