# AI analytics logging evidence checklist

This is a blank evaluation record, not a security certification or completed product test.

- Product / version / plan:
- Interface (internal chat, embedded, API, other):
- Deployment and database engine:
- Approved synthetic test scope:
- Application user / tenant / database identity:
- Evaluation owner / date / timezone:

| Requirement                                          | Evidence location and identifiers | Observed result | Gap / owner / next action |
| ---------------------------------------------------- | --------------------------------- | --------------- | ------------------------- |
| Original question and authenticated user             |                                   |                 |                           |
| All generated attempts, including retries            |                                   |                 |                           |
| Executed SQL and database identity                   |                                   |                 |                           |
| Engine query/job IDs linked to request               |                                   |                 |                           |
| Explicit access denial and enforcement point         |                                   |                 |                           |
| Final response linked to completed attempt           |                                   |                 |                           |
| Pagination, duplicate timestamps and delayed records |                                   |                 |                           |
| Export completeness and deduplication                |                                   |                 |                           |
| Log readers and alteration controls                  |                                   |                 |                           |
| Retention, deletion, backups and exports             |                                   |                 |                           |

Do not enter credentials or real customer data. Record unavailable evidence as a gap. A missing event is not proof of denied access. Generated SQL is not proof of execution.

## Decision

- Accepted scope:
- Unresolved requirements:
- Reviewer:
- Next validation date: