For a disputed effect, I want a chain of decisions and observations, not an unbounded transcript. Give the run, proposed action, approval, broker operation, provider request, provider receipt, and reconciliation one stable operation ID. Store the canonical effect arguments and policy version that were authorized, or an encrypted narrowly accessible record plus its digest where those arguments contain private data. Store who approved, on whose delegated authority, what exact preview they saw, when approval expired, and which source preconditions were checked immediately before execution. A model sentence saying “the credit was applied” is not provider evidence. A transport timeout is an unknown effect until the provider receipt or reconciliation resolves it.

Append audit events at each transition. Each event carries run ID, operation ID, actor identity, tenant, event type, timestamp, result state, pointers to the evidence it relied on, and the prior event digest. Sign or periodically anchor batches in an independently controlled store with restricted delete rights. The AWS CloudTrail integrity mechanism is a concrete example of signed digests referencing log files. It also illustrates a limit: enabling integrity delivery does not itself validate anything. We must actually check signatures and completeness, detect gaps, and make logging health visible. A hash chain detects later modification of recorded events. It does not prove that a compromised broker recorded an event honestly in the first place.

Now the deletion request. Separate the short lived conversation and retrieved content from the longer lived, minimal effect record under the applicable retention agreement. The audit record may retain a digest and typed fact such as “approved credit of 50 units to account token X” where permitted, while the raw chat and evidence blob expire. A bare digest is usually insufficient to explain why a disputed action was permitted, and retaining a digest of a low entropy secret can itself leak information by guessing. Decide which fields must remain, protect them, and link any legally required deletion exception to its basis. If the audit retention also ends, destroy the underlying record through the defined process and preserve only whatever deletion receipt is allowed. These are policy and contract choices, not universal retention periods.

I would rehearse three investigations: a provider success with lost response, an approval changed after the preview, and a missing audit batch. Can an investigator reconstruct the effective operation and its outcome without granting general access to tenant conversations? Can they identify an unknown outcome honestly? That is the measure of the audit design.