Audit — the attribution-trail bounded context
The platform's memory: a per-tenant log with polymorphic attribution — partner actions carry the attributed org, RiverSync view-as actions carry the session and land in both the customer's log and the RiverSync trail. It writes nothing of its own; it remembers everything everyone else does. A generic subdomain, integrated as a pure conformist to the published event language.
1Ownership & boundaries
Audit is a pure consumer with a read API. There is no public write endpoint: facts arrive on the backbone (SVC-8), already carrying actor, attributed org and view-as session in the envelope. ViewAsSession itself belongs to Identity — Audit only references it for the dual-trail pairing.
Reads from: the whole event backbone (wildcard subscription) · Identity (ViewAsSession attribution). Account reads the customer log; Admin reads the cross-tenant trail.
2Ubiquitous language
The words this context uses — the same in code, conversation and spec.
3Aggregates & invariants
One append-only aggregate — the root guards immutability and the polymorphic attribution; facts arrive only on the backbone.
4Context relationships
How this context meets its neighbours — a conformist downstream of every context, consuming the published event language.
5Physical view — the service API
The deployment mapping: this context becomes the Audit service — a read API only; the write side is the backbone. Paths relative to api.riversync.com/v1; access notation per the master.