Yes, you nailed it with "it shouldn't be routine" and there for sure should be a review process. My primary concern with the audit logs actually isn't security

Yes, you nailed it with "it shouldn't be routine" and there for sure should be a review process. My primary concern with the audit logs actually isn't security it's lowering the cowboy of the software lifecycle > combined with some kind of “taint” mode where your access to a server triggers a rebuild after the dust has settled. Oh, I love that idea: thanks for bringing it to my attention. I'll for sure incorporate that into my process going forward