{
  "license": "CC BY 4.0",
  "recipe": {
    "slug": "privileged-action-audit-trail",
    "title": "Audit Privileged Actions with SQL",
    "testedWith": "Apache DataFusion 45.2.0",
    "lastReviewed": "2026-07-28"
  },
  "contract": {
    "tableName": "security_audit_events",
    "schema": [
      {
        "name": "timestamp_utc",
        "type": "Timestamp",
        "description": "Action completion time in UTC."
      },
      {
        "name": "actor_role",
        "type": "Utf8",
        "description": "Bounded role class; avoid email addresses in broad reporting tables."
      },
      {
        "name": "action",
        "type": "Utf8",
        "description": "Controlled privileged-action name."
      },
      {
        "name": "resource_type",
        "type": "Utf8",
        "description": "Resource class without raw resource contents."
      },
      {
        "name": "outcome",
        "type": "Utf8",
        "description": "Terminal success, denied, or failed outcome."
      },
      {
        "name": "requires_review",
        "type": "Boolean",
        "description": "Whether policy requires a human review."
      },
      {
        "name": "environment",
        "type": "Utf8",
        "description": "Deployment environment."
      }
    ]
  },
  "query": "SELECT\n  action,\n  COUNT(*) AS actions,\n  SUM(CASE WHEN outcome <> 'success' THEN 1 ELSE 0 END) AS failed_actions,\n  SUM(CASE WHEN requires_review THEN 1 ELSE 0 END) AS review_required,\n  100.0 * SUM(CASE WHEN outcome <> 'success' THEN 1 ELSE 0 END)\n    / NULLIF(COUNT(*), 0) AS failure_rate_pct\nFROM security_audit_events\nWHERE timestamp_utc >= now() - INTERVAL '30 days'\n  AND environment = 'production'\nGROUP BY action\nORDER BY failed_actions DESC, failure_rate_pct DESC, action;",
  "fixtureKind": "reproducible",
  "inputRows": [
    {
      "timestamp_utc": "2026-07-28T18:00:00.000Z",
      "actor_role": "owner",
      "action": "permissions_changed",
      "resource_type": "role",
      "outcome": "success",
      "requires_review": true,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:53:00.000Z",
      "actor_role": "owner",
      "action": "permissions_changed",
      "resource_type": "role",
      "outcome": "success",
      "requires_review": false,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:46:00.000Z",
      "actor_role": "support",
      "action": "permissions_changed",
      "resource_type": "role",
      "outcome": "denied",
      "requires_review": true,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:39:00.000Z",
      "actor_role": "owner",
      "action": "data_exported",
      "resource_type": "workspace",
      "outcome": "success",
      "requires_review": false,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:32:00.000Z",
      "actor_role": "support",
      "action": "data_exported",
      "resource_type": "workspace",
      "outcome": "denied",
      "requires_review": true,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:25:00.000Z",
      "actor_role": "developer",
      "action": "api_key_created",
      "resource_type": "api_key",
      "outcome": "success",
      "requires_review": false,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:18:00.000Z",
      "actor_role": "owner",
      "action": "api_key_created",
      "resource_type": "api_key",
      "outcome": "success",
      "requires_review": true,
      "environment": "production"
    }
  ],
  "illustrativeInputRows": [
    {
      "timestamp_utc": "2026-07-28T18:00:00.000Z",
      "actor_role": "owner",
      "action": "permissions_changed",
      "resource_type": "role",
      "outcome": "success",
      "requires_review": true,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:53:00.000Z",
      "actor_role": "owner",
      "action": "permissions_changed",
      "resource_type": "role",
      "outcome": "success",
      "requires_review": false,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:46:00.000Z",
      "actor_role": "support",
      "action": "permissions_changed",
      "resource_type": "role",
      "outcome": "denied",
      "requires_review": true,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:39:00.000Z",
      "actor_role": "owner",
      "action": "data_exported",
      "resource_type": "workspace",
      "outcome": "success",
      "requires_review": false,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:32:00.000Z",
      "actor_role": "support",
      "action": "data_exported",
      "resource_type": "workspace",
      "outcome": "denied",
      "requires_review": true,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:25:00.000Z",
      "actor_role": "developer",
      "action": "api_key_created",
      "resource_type": "api_key",
      "outcome": "success",
      "requires_review": false,
      "environment": "production"
    },
    {
      "timestamp_utc": "2026-07-28T17:18:00.000Z",
      "actor_role": "owner",
      "action": "api_key_created",
      "resource_type": "api_key",
      "outcome": "success",
      "requires_review": true,
      "environment": "production"
    }
  ],
  "expectedOutput": {
    "columns": [
      "action",
      "actions",
      "failed_actions",
      "review_required",
      "failure_rate_pct"
    ],
    "rows": [
      {
        "action": "data_exported",
        "actions": 2,
        "failed_actions": 1,
        "review_required": 1,
        "failure_rate_pct": 50
      },
      {
        "action": "permissions_changed",
        "actions": 3,
        "failed_actions": 1,
        "review_required": 2,
        "failure_rate_pct": 33.33333333
      },
      {
        "action": "api_key_created",
        "actions": 2,
        "failed_actions": 0,
        "review_required": 1,
        "failure_rate_pct": 0
      }
    ]
  },
  "notes": [
    "The included synthetic input rows generate the expected output when timestamps are shifted into the documented query window.",
    "Run this fixture in the public browser SQL playground; the selected query executes locally with DuckDB-Wasm.",
    "Adapt time windows, thresholds, identities, and business definitions before operational use."
  ]
}