6 — Audit Logging
The query audit log as a first-class security artifact — what a query-audit event must record (including the resolved scope, not just the query text), why it has to live apart from everything it audits, tamper-evidence, and compliance-driven retention.