{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T01:00:52.414Z",
  "record_id": "VXI-EXT-PROCUREMENT-VAULT-AUDIT-01-v1",
  "record_kind": "external_reference",
  "title": "Vault: Audit availability, coverage and hashed values",
  "system": "HashiCorp Vault audit devices",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a working Vault server prove its secret-access audit trail is complete?",
  "near_questions": [
    "Does a running Vault server prove auditing is enabled?",
    "Are Vault operational logs the same as audit logs?",
    "Can one audit device miss events saved by another?",
    "What happens when every enabled audit device fails?",
    "Do audit hashes reveal the original secret values?",
    "Are all Vault endpoints audited?",
    "What evidence shows when auditing began?",
    "Does disabling an audit device erase existing logs?",
    "Can a new hashing key explain unmatched audit values?",
    "What should procurement request for an audit availability claim?",
    "Can I save the documented Vault audit boundary?",
    "When should a secrets-service logging review be repeated?"
  ],
  "supported_claims": [
    {
      "claim": "Vault distinguishes operational logs from audit devices, which must be enabled on a new cluster. With auditing enabled, a request requires a successful write to at least one enabled device; one device need not contain the whole history. Documented endpoint exceptions and hashed values also limit interpretation.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Vault distinguishes operational logs from audit devices, which must be enabled on a new cluster. With auditing enabled, a request requires a successful write to at least one enabled device; one device need not contain the whole history. Documented endpoint exceptions and hashed values also limit interpretation.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-CLOUDTRAIL-COVERAGE-01-v1",
    "VXI-EXT-PROCUREMENT-AZURE-ACTIVITY-01-v1",
    "VXI-EXT-PROCUREMENT-GOOGLE-DATA-ACCESS-01-v1",
    "VXI-EXT-PROCUREMENT-PURVIEW-RETENTION-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Vault audit device enablement, availability and hashing boundaries",
    "source_url": "https://developer.hashicorp.com/vault/docs/audit",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-VAULT-AUDIT-01-v1",
    "candidate_record_sha256": "5e68477b3a97ef5d3e50f9af07ca51f690196cfdd955c26127e9ef7ac6143744",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Vault distinguishes operational logs from audit devices, which must be enabled on a new cluster. With auditing enabled, a request requires a successful write to at least one enabled device; one device need not contain the whole history. Documented endpoint exceptions and hashed values also limit interpretation.",
    "required_buyer_context": "Identify Vault version, cluster, audit devices, enabled period, requested operation and any hashing or exclusion settings.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "Operational server logs alone prove complete secret-access auditing.",
    "documented_statement": {
      "status": "documented",
      "statement": "Vault distinguishes operational logs from audit devices, which must be enabled on a new cluster. With auditing enabled, a request requires a successful write to at least one enabled device; one device need not contain the whole history. Documented endpoint exceptions and hashed values also limit interpretation.",
      "source_ids": [
        "vault"
      ]
    },
    "buyer_evidence_required": [
      "Enabled audit-device configuration and dates",
      "Combined device records and evidence of collection/retention",
      "Relevant endpoint exceptions and hashed-field interpretation"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not certify a complete access history from process logs, a single device or uninterpreted hashes."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "vault",
        "url": "https://developer.hashicorp.com/vault/docs/audit",
        "final_url": "https://developer.hashicorp.com/vault/docs/audit",
        "title": "Vault audit device enablement, availability and hashing boundaries",
        "checked_on": "2026-10-14",
        "sha256": "c9d3e98a510e00de003187b4abc498498ce4177641a2b0e3642cb45a1448f6ca",
        "bytes": 290974
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the evidence questions behind a secrets-service audit claim.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck device changes, availability, exceptions and version-specific logging behaviour."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#vault-audit-device-availability-check",
  "machine_readable_record": "/varexis-index/records/vault-audit-device-availability-check.json"
}