The audit log is a feature, not a debugging tool

Audit logging added late becomes a scattering of ad-hoc writes. Added early, as an interceptor around the mutation boundary, it costs almost nothing and covers everything.

What to record

Actor, action, entity, entity id, a redacted before/after diff, request id, IP and user agent. Secrets and password hashes are stripped before the row is written — an audit trail that leaks credentials is a liability, not a control.