# Audit Interface Pattern Migration

Audit contributes two read-only administration surfaces through the shared
`admin.sections` capability. Both use the platform's monitoring and evidence
archetype.

## Surface Map

| Surface | Authority | Pattern | Consequence class |
| --- | --- | --- | --- |
| `audit.admin.system` | `system:audit:read` | Server-filtered evidence grid and event inspector | Read-only evidence disclosure |
| `audit.admin.tenant` | `audit:read` for the active tenant | Server-filtered evidence grid and event inspector | Read-only evidence disclosure |

Audit does not expose mutation or destructive actions in these panels. The
only row action opens an inspection dialog; reload preserves the stable shell
and existing evidence while a newer projection is requested.

## Interaction Contract

- Core owns the admin layout, DataGrid, dialog, action group, loading/error
  treatment, disabled-action explanation, and documentation link.
- Filtering, sorting, counts, and paging are server-owned. The first page may
  apply bounded delta updates using an opaque watermark; a full response
  remains authoritative when the delta contract cannot be used.
- System and tenant panels remain distinct and are registered only with their
  respective read scopes. Tenant selection is never accepted as a free-form
  client override.
- The event inspector renders stable actor, action, object, tenant, timestamp,
  and structured detail rows. It does not add editing, replay, export, or raw
  credential access.
- Contextual help resolves through `audit.read-authorized-evidence`; operational
  recording, retention, and outbox guidance remains in the separate admin
  topic.

## Verification

Run the Audit backend suite and `npm run test:interface-patterns` in `webui`.
The structural test guards shared components, localized labels, contextual
help, server paging, readable detail projection, and absence of private sibling
imports or browser-native dialogs.