Audit rules

Rule syntax, evaluation order and extension points.

An audit rule is a named condition evaluated against an event. Rules are data, editable in the interface, and extensible in Python where a condition needs more than the built-in operators.

Rule shape

{
    "name": "Large partner export",
    "event": "export",
    "model": "res.partner",
    "condition": "row_count > 1000",
    "severity": "high",
    "actions": ["alert.email", "alert.webhook"],
}

Evaluation order

• Rules are evaluated per event, in ascending sequence order.
• A matching rule does not stop evaluation unless it sets stop_after.
• Actions are queued, not executed inline, so a slow webhook cannot block a write.
• Failed actions retry with backoff and surface in the delivery log.