Retrofitting is the expensive path

Access control, audit history and evidence capture are usually deferred because no customer asks for them in the first sales conversation. They become urgent at the first enterprise security review or the first audit, at which point the data required to answer the question was never recorded.

History cannot be reconstructed. That asymmetry is what makes these decisions worth making before the first feature ships, even for a product with no compliance obligation yet.

Four decisions to make early

Each of these is inexpensive at design time and structurally difficult to introduce later.

  • Append-only history for anything a third party may later question. Overwritten state is lost state.
  • Access enforced at the data layer, not only in application code. A query written without the tenant filter should fail, not succeed quietly.
  • Attribution and timestamps on every record that could serve as evidence, captured by the system rather than entered by a person.
  • Reference data versioned separately from customer records, so a standards or regulatory change is a new version rather than a migration.

Evidence is a design output

A control that exists but produces no evidence cannot be assured. The practical discipline is to state, for each control, what artefact would prove it operated — then check whether the system produces that artefact automatically. If it depends on someone remembering to save a screenshot, it will not survive delivery pressure.

This is what turns audit preparation from a multi-week exercise into an export. The measurable outcome worth tracking is time from audit request to evidence pack.

Explainability over sophistication

In regulated contexts, a detection rule that can be explained and reproduced is worth more than a model with marginally better coverage. Auditors do not evaluate accuracy; they evaluate whether you can demonstrate what happened and why.

That constraint should be treated as a design input rather than a limitation. It rules out a set of approaches early, which usually simplifies the build.