Sign-in, password change, and permissions — with audit as PostgreSQL triggers, not application middleware. One retired system wrapped every audit write in .catch(console.error), so the financial action succeeded and its audit record silently vanished.

Done when every insert, update and delete on business data is recorded with who, when, and the before/after — including a deliberate direct database change.