Audit logging of mutating changes to OpenFGA

[danielloader]

Figured I'd kick this discussion off, I'm currently working on how to save an append only log of all the tuples added/removed to the openFGA system.

I've currently only got a fragile solution around wrapping the http calls in an audit log event which itself submits a record to a database but if either of those transactions fails I'm left with an incomplete or inaccurate audit log of what has happened.

Any ideas, solutions, or designs would be appreciated.

[ewanharris]

👋🏻 OpenFGA does keep a changelog of all tuples written that can be accessed via the /changes API with the relevant readChanges function in an SDK.

If you were looking to maintain this outside of OpenFGA and improve reliability you could potentially look towards a pattern such as an outbox pattern or a change data capture solution that would allow you to write to FGA and the append only log separately.