RBAC Audit Logging (issue 21 of 29)

Labels: ready-to-code
Depends on: Issue 3 (#4041 permission definitions)
RHIDP Stories: RHIDP-15279, RHIDP-15280
Feature: RHDHPLAN-1508 — Epic RHIDP-15277

Implement audit event infrastructure: define posture-change and policy CRUD event types, define ingestion sync events (start/success/failure), integrate with RHDH audit log channel, add config change tracking with actor identification and before/after capture, and implement disconnected cluster support with local audit log fallback and event queuing.

Tasks

From openspec/changes/ai-catalog-asset-governance/tasks.md group 7 (RHIDP-15277, RHIDP-15279, RHIDP-15280):

• 7.1 Define audit event types: posture-changed, policy-created, policy-updated, policy-deleted (RHIDP-15279)
• 7.2 Define ingestion audit events: sync-completed, sync-error, entity-created, entity-updated, entity-deleted (RHIDP-15280)
• 7.3 Implement audit event emitters using LoggerService with structured metadata
• 7.4 Integrate audit events into posture change and policy CRUD flows
• 7.5 Integrate audit events into entity provider sync cycle
• 7.6 Verify events do not duplicate RBAC plugin AuditorService coverage

From openspec/changes/ingestion-audit-metrics/tasks.md groups 1–4:

Group 1 (Audit Event Infrastructure):

• 1.1–1.8 Define ingestion audit event types, payload schema, emission helpers, RHDH audit log integration, serialization, validation, unit tests

Group 2 (Sync Audit Integration):

• 2.1–2.10 Lifecycle hooks (onSyncStart, onSyncSuccess, onSyncFailure), event emission, connector integration, asset count tracking, error serialization, integration tests

Group 3 (Config Change Audit):

• 3.1–3.6 Config change tracking, event emission, actor capture, before/after values, field serialization, integration tests

Group 4 (Disconnected Cluster Support):

• 4.1–4.5 Local audit log fallback, event queuing, file system persistence, replay mechanism, unit tests

Specifications

• openspec/changes/ai-catalog-asset-governance/specs/audit-logging/spec.md
• openspec/changes/ingestion-audit-metrics/specs/audit-events/spec.md

Start by reading the listed specifications in openspec/changes/ai-catalog-asset-governance/specs/audit-logging/spec.md and openspec/changes/ingestion-audit-metrics/specs/audit-events/spec.md, then review the corresponding task groups in their tasks.md files. Done means the event infrastructure, sync and config integrations, disconnected-cluster fallback, persistence, replay, validation, and tests described there are implemented without duplicating RBAC AuditorService coverage.