Logging of policy checks

[Rodeoclash]

Hi,

I'm curious if others are handling logging of policy checks and how they're going about it.

One of our requirements is to provide evidence that we're logging policy checks and if others have done this then I'd be interested in how they've gone about it.

My current policy document is quite simple and just checks ownership of structs as follows:

defmodule SuperApi.Policy.Checks do
  alias SuperApi.{
    Employers.Employer,
    Products.Product,
    Repo,
    OnboardingSessions.OnboardingSession
  }

  def owner(%Product{id: id}, %Employer{product_id: id}), do: true

  def owner(%Product{id: id}, %OnboardingSession{} = onboarding_session) do
    onboarding_session = Repo.preload(onboarding_session, :product)
    onboarding_session.product.id == id
  end

  def owner(%OnboardingSession{mobile_number: mobile_number}, %OnboardingSession{
        mobile_number: mobile_number
      }),
      do: true

  def owner(%OnboardingSession{email: email}, %OnboardingSession{email: email}), do: true

  def owner(_, _), do: false
end

My initial reaction was to add some logging directly in the policy checks above but perhaps theirs a better place to hook into these checks.

Very interested to see what others might have done here.