Your Rails audit log has 4 blind spots. Auditors know all of them.

By the Steadybyte team Search for "Rails audit log" and you'll find good answers: paper_trail, audited, logidze, and many tutorials that add an after_save callback and an audits table. They all answer one question well: what changed, and who changed it? That's often enough until your first HIPAA risk assessment, SOC 2 audit or enterprise security questionnaire. Then the questions get wider. This post walks through those questions, shows where change tracking stops, and explains how to close ea