---
kind: task
slug: audit-instrument-objects-mutations
title: Audit-instrument every mutation in the objects router
plan_slug: multitenant-saas-hardening
epic_slug: tenant-lifecycle
status: draft
priority: P2
tenant_id: global
owner: unassigned
cursor_todo_id: null
updated_at: "2026-06-02"
---

# Task summary

`Task-workspace-soft-delete-and-audit` shipped `recordAudit()` and instrumented every mutation in `workspaces` and `invites`. The objects router has ~10 mutation procedures (`create`, `update`, `move`, `archive`, `restore`, `setProperties`, `bulkUpdate`, `addAssignee`, `removeAssignee`, etc. — verify against the current router before scoping).

Deferred from the parent task because:

1. Auditing ALL of them risks producing low-signal-high-noise rows. We want a thoughtful cut (e.g. skip property edits, keep status changes).
2. Some procedures fan out to multiple rows (`bulkUpdate`) — one audit row per batch with a `count` field is probably right, not one per affected object.

## Subtasks

- [ ] Enumerate every mutation in `apps/web/server/routers/objects.ts` with a one-line "should we audit this?" verdict.
- [ ] Pick the audit-worthy cut and add `recordAudit` calls to each, with `metadata` that's actually useful (title for create, before/after status for status change, count for bulk).
- [ ] Decide on a fan-out policy for bulk procedures — one row per batch (recommended) vs. one row per affected object (noisy).
- [ ] Update the audit view to render object-action labels.

## Acceptance criteria

- [ ] Every audit-worthy `objects` mutation writes one or more audit rows.
- [ ] No-audit procedures are documented inline ("audit-skip: …").

## Links

- Parent: `./Task-workspace-soft-delete-and-audit.md`
- Epic: `./Epic-tenant-lifecycle.md`