n0rds3c.dev / notes / draft
Design the audit model before the first feature
. Draft. Not finished; the argument is here, the polish is not.
Every later system in Vault AI was easier because the trail already existed. Approvals, tenant isolation, and the realtime gateway all hung off a record that was there before any of them.
Early guardrails lived in the UI. The first integration that bypassed the UI proved they had to move into the API layer, where they now sit next to the tenant checks. The audit model told us where they belonged before the incident did.
The habit I would push on any team building something that has to be reviewed later: decide what a row in the trail looks like before you decide what the first screen looks like. Who acted, on what, under which tenant, with which approval, and the hash of the row before it. Once that shape exists, every feature is a question of what it writes to the trail, and features that cannot answer that question are usually the ones that should not ship yet.
It also changes what a demo is. A demo that produces no trail is a sketch. A demo that produces a trail is a product with a small surface area. The second one is slower to build for about two weeks and faster forever after.