# description
Additional conformance requirements for identity and access management audit events. Every requirement adds to the OpenAuditModel Core Specification; none relaxes it.

# rules[].description
Every identity operation records the authorization decision that permitted it.

# rules[].rationale
An access change without a recorded decision cannot be reviewed: nothing distinguishes a change a policy allowed from one that bypassed policy entirely.

# rules[].description
Every identity operation records why it was performed and how it correlates with the request that caused it.

# rules[].rationale
Access changes are reviewed long after the fact, by someone who cannot ask the actor what they were doing.

# rules[].description
Role assignment and revocation identify the role and whether it is privileged, and record a justification.

# rules[].rationale
The privileged flag is what makes a later reviewer able to separate routine access changes from the ones that matter, without knowing the operator's role catalogue.

# rules[].description
A privileged role change is approved and performed from a multi-factor authenticated session.

# rules[].rationale
Privileged access is the control that protects every other control; granting it on the strength of a single factor and one person's judgement is the failure this rule exists to make visible.

# rules[].description
Permission grants and revocations identify the permission, its scope and whether it is privileged.

# rules[].rationale
A permission without a scope cannot be assessed: the same permission over one record and over an entire tenant are different operations.

# rules[].description
A privileged permission change is approved and performed from a multi-factor authenticated session.

# rules[].rationale
Direct permission grants bypass the role model, so they warrant the same scrutiny as a privileged role change.

# rules[].description
User lifecycle events record the kind of principal the account represents.

# rules[].rationale
Distinguishing an employee account from a contractor, partner or test account is what makes an access review answerable. It requires no personal data.

# rules[].description
Disabling or deleting an account records why.

# rules[].rationale
Account removal is indistinguishable from account suppression without a stated reason, and the two have very different implications.

# rules[].description
Service account lifecycle events record the account's purpose and a human owner.

# rules[].rationale
Unowned service accounts outlive the systems that needed them. Recording an owner at creation is the only point at which the answer is known.

# rules[].description
Service account creation records when the account is expected to expire.

# rules[].rationale
A recorded expiry turns an indefinite credential into a reviewable one. It is recommended rather than required because not every service account can be time-bound.

# rules[].description
Credential rotation records the authorization, the justification and the kind of credential rotated.

# rules[].rationale
The kind of credential determines the blast radius of the rotation. The credential itself must never appear in the event; see the profile documentation.