Audit logging is not authorization

Recording who did what is valuable. It is not the same as deciding whether they may do it. Audit logs capture events after (or around) an action: actor, resource, timestamp, outcome. Authorization dec