Comment by sneak

Thought experiment: design an architecture that passes this audit scope as written that allows for logging of user activity.

I can think of at least one.