Event Architecture

Every meaningful action in AuthSpoke emits an immutable event. This keeps the platform loosely coupled — the UI, audit, notifications and future analytics all consume the same stream rather than calling each other.

Properties#

• Append-only — events are never mutated.
• Tenant-scoped — every event belongs to a tenant.
• Side-effect, never blocking — recording an event must never break the action that produced it. The event sink swallows its own failures so the primary write always succeeds.
• Typed and severity-tagged — eventType plus INFO / WARNING / CRITICAL.

Producers#

Agent and MCP create/update/delete, entitlement changes and kill-switch flips all emit events (AGENT_REGISTERED, MCP_REGISTERED, ENTITLEMENT_CHANGED, KILL_SWITCH_CHANGED, …).

Consumers#

• The live activity feed (GET /ai/activity)
• Per-subject timelines (GET /ai/activity/{subjectId})
• Future: SIEM export, notifications, behavior analytics

Why this matters for you#

Because events are first-class, you can build your own consumers — dashboards, alerting, compliance evidence — on the same stream the product uses. See AI Audit & Events.