Annotation Interface Audit

@Retention(RUNTIME) @Target({TYPE,METHOD}) public @interface Audit
Marks a service type or method as carrying audit policy metadata.

This annotation is a declaration on the application contract. It does not, by itself, install an interceptor, emit an audit event, persist an audit record, or change authorization behavior. A runtime component, descriptor processor, administrative policy, or application-specific dispatcher must explicitly consume the metadata and route safe, redacted event details to an AuditPublisher or equivalent policy boundary.

Audit consumers must preserve the normal J7M security model: a remote reference is not authorization, server-side authorization remains authoritative, and sensitive values must be redacted before they are written to logs, audit records, status DTOs, or demo output.

API note: The annotation has runtime retention so descriptor builders and explicit validation tools can inspect it. Current annotation-first examples demonstrate the metadata and local redaction evidence; they do not claim universal audit interception for every runtime path.

  • Optional Element Summary

    Optional Elements
    Modifier and Type
    Optional Element
    Description
    String
    policy
    Selects a trusted host-installed audit policy; application metadata cannot install a sink.

  • Element Details

    • policy

      String policy
      Selects a trusted host-installed audit policy; application metadata cannot install a sink.
      Returns:
      public policy identifier, defaulting to the host's default audit policy
      Default:
      "default"