Access paths
Why access logs matter more than locks
Locks photograph well. Logs rarely do. Yet most storage surprises we see at Apibridge Hub show up first as odd successful access at odd hours — not as a broken latch.
Locks answer a different question
A cabinet lock or disk passphrase answers “was there a barrier?” Access logs answer “who crossed the barrier, from where, and how often?” Reviews that stop at the first question miss service accounts, cached tokens, and forgotten sync agents.
Sample instead of drowning
Pull a bounded window: seven days if traffic is light, forty-eight hours if it is heavy. Filter to write operations and failed attempts. Sort by identity, not by timestamp alone. You are looking for shapes — a human identity writing at 03:10 every night is a story waiting for a name.
Exceptions are the curriculum
Guest links, break-glass users, and “temporary” VPN routes often outlive their tickets. Record each exception with an owner and an intended expiry. If nobody claims it, that is the finding.
What logs cannot do
They will not prove intent, and they will not replace encryption posture checks. Use them to prioritize which path to walk next in your worksheet — then verify on the control plane.
Continue with Vault Audit Fundamentals or reading a storage audit report.