Audit logs for B2B SaaS: what enterprise security reviews ask, and a Postgres schema that answers it

The first enterprise deal usually arrives with a security questionnaire, and somewhere in it is a version of the same question: "Do you keep an audit log, and can our admins see it?" If the honest ans