NotesEntitlement Is Stored as State, Not as History

Entitlement is better instrumented than access logs alone suggest. Group membership, role codes, exception tickets, watchlist state: most of what authorises an action is recorded somewhere, and a program that only reads activity logs is reading half of what it holds.

The harder problem is that much of it is held as current state rather than as history.

A time-boxed exception makes this concrete. Say USB access granted for a fortnight through a ticket, with an approver and an expiry. While it is live it is authoritative: query the system and it tells you this person may do this thing. When it lapses, the person leaves the watchlist and the state returns to normal. Two months later the activity is still in the logs and the authorisation that covered it is not, at least not anywhere you would query first.

So the investigative question is rarely whether someone had the entitlement. It is whether you can still show they had it at the time, which is a different question and often a harder one.

This matters in two directions, and the second is the one that gets missed.

The obvious direction is proof of wrongdoing. An action that looks unauthorised in retrospect may have been covered by a permission nobody preserved.

The direction that matters more is exculpation. The record that would clear a person is exactly the record most likely to have expired, because temporary permissions are temporary by design. A case built two months after the fact starts from an evidence base that is systematically biased against the subject: the activity persists, the justification decays. Nobody designed that asymmetry. It is a side effect of storing entitlement as a live state, which is the sensible way to store it for every purpose other than this one.

The fix is not more logging. It is deciding, before you need it, which authorisation facts have to be preserved as events rather than read as state, and accepting that this is a retention decision with its own cost and its own lawful basis. Which makes it one more thing that has to be settled early, and one more thing that quietly decides how fair a case can be.