Short answer: Give every login attempt, risk decision, and session mutation one correlation ID, then record immutable events before enforcing the decision. For an edtech login scored from a device fingerprint, the useful trail is not a pile of request logs. It is a causal chain that can answer which signal changed, which policy fired, which session was rotated or revoked, and whether the learner completed reauthentication.
Start with four event families: authentication attempts, device-risk evaluations, policy decisions, and session lifecycle actions. Keep both the raw security outcome and the policy version that interpreted it. That separation lets an eval harness replay yesterday's inputs against tomorrow's policy without rewriting history.
How should an authentication audit trail correlate risk events with session lifecycle actions?
Use a correlation ID for the whole authentication flow and stable opaque IDs for the subject, device, and session. The login handler creates the correlation ID. The fingerprint service emits a risk event under it; the policy layer emits a decision; the session layer records the resulting creation, rotation, restriction, or revocation. A parent event ID makes branches explicit when one risk decision affects several active sessions.
