The question an audit trail has to answer
Not 'what changed' — the record already shows that. The real question is 'why does this record look like this', and answering it requires knowing who acted, on whose authority, as part of which operation, and what else that same operation touched. A deletion is only explicable next to the escalation that preceded it.
What a correlation identifier buys you
- A single operation that touches six tables reads as one event, not six.
- A failure halfway through is visible as a partial operation rather than an inconsistency.
- Requests can be traced across function boundaries and back to the caller.
- Automated activity can be reconstructed after the fact without guessing.
Auditing must not become a failure mode
There is a genuine tension: an audit write that fails should not roll back the business operation it was recording, but silently swallowing it leaves a hole. The resolution is to isolate the side effect so a logging failure cannot destroy a core write, and to treat missing audit coverage as a defect found by inspection rather than by incident.