- 已装运
- 2026年8月3日 03:22 UTC
- 作者
- Kamo
- 提交
- 51b103d
HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "who looked at this borrower" — the first question a §164.402 breach assessment asks — was unanswerable. PhiAccessAuditor builds events from the OTK/*** session map the endpoint already resolved, so the identity in the audit row is the same identity that authorised the request. Client IP comes from X-Forwarded-For; behind Traefik, remoteAddr records the ingress pod and is worthless for detection. Denials are recorded too — probing is what detection looks for — and a sessionless caller lands on a sentinel org rather than being dropped. Reads: single lead fetch = VIEW, grid = one LIST event per lead actually shipped (taken from the projected DTOs, so a lead filtered out by VIEW_UNASSIGNED_LEADS never appears as one that was read). 401/403/404 all record a denial. Exports fail closed — access-log CSV, HMDA LAR, the QC training corpus and the platform-wide extraction corpus. Each records one event per record BEFORE the file is built, and a failed audit write returns 503: "we handed out the data but lost the record" is the one answer that cannot be walked back. The platform-wide corpus crosses every tenant, so each record is attributed to the org that owns it, not the operator's. Only identifiers are logged, never content. **************** memberId) is gone: an export now has to hold its rows to record who was in them.