Almost every tool-governance layer I have looked at writes its log after the call returns. Some write it in a finally . Some batch it. Some hand it to a logging framework that flushes on its own schedule. That ordering quietly decides what your log can be used for. If the record is written after the body runs, then a record that is missing has two possible explanations, and nothing in the file distinguishes them: The call was never authorised, so it never ran. The call was autho...