Evaluation Audit Events
Audit records created by policy evaluation.
Every POST /policy/evaluate call writes an audit log regardless of outcome. Fields include agent, action, resource, policy name, result (allowed/blocked/approval_required), severity, and timestamp.
If audit persistence fails after an allowed evaluation, the API returns 503 audit_persist_failed. This is a fail-closed behavior — the evaluation result is not returned without a successful audit write.