- Ya
- 4 Agosti 2026, 04:10 UTC
- Mwandishi
- kamo
- Ahadi ya
- e1fdbc5
The trail was being written and nothing could read it. This is the screen half: an org-wide access review under Settings → Security, and a "who has accessed this record" dialog opened from the lead itself, which is the shape a §164.528 accounting request actually arrives in — an individual asking about their file, not someone with time to filter a global log. Three things here are not cosmetic. Timestamps are absolute and always name the zone they were rendered in, with a one-click switch to UTC. This evidence is read months later by someone who was not present; a bare wall-clock read from another zone silently misplaces an access by hours, which is the difference between "during the shift" and "at 3am". Relative times are excluded outright — they drift every time the page is opened. Denied attempts and platform-staff access are marked on the row (tint, left rule, leading icon) rather than left in a column the eye skips, because a compliance officer scans hundreds of rows for the one that should not be there. Ordinary reads are deliberately plain: decorating everything is the same as decorating nothing. Denied outranks platform-staff when a row is both — Kamo staff being refused is the most interesting line the screen can show. Export is gated on EXPORT_ACCESS_LOGS separately from the view right, and a 503 from the upstream is surfaced as "nothing was disclosed" rather than smoothed into a generic error. EXPORT is a fail-closed audit kind: the refusal means the disclosure could not be recorded, which is a correct outcome the officer needs to see. Query building, timestamp formatting and row classification live in app/lib so vitest can reach them; the components are assembly. A 403 never falls through to an empty grid — "nobody has ever touched this record" is the most dangerous wrong answer this screen can give.