Design: audit trail and human-in-the-loop approval gates

[gidutz]

Every spend-affecting action must be logged with rationale, and actions above configurable thresholds must require human approval before execution.

Required behaviors:

• Immutable, append-only audit log
• Rationale captured at decision time, not reconstructed after
• Approval gates configurable per role, per platform, per dollar threshold
• Approval UX: how does a human approve from where they already are (Slack, email, dashboard)?
• Reversal / rollback recordkeeping

Open questions:

• Storage model for audit log (separate from operational store?)
• Replay: can we reconstruct the agent's state at the moment of a decision?
• Compliance fit (GDPR, CCPA, SOX, regional ad regulations)

Deliverable: audit log schema plus HITL approval flow spec.