ci(decision-model-lint): Split the audit rule into narrow checks

Replace the broad auth-change audit rule with four narrow rules for
secret rotation, token issuance and revocation, privilege grants, and
account identity changes. In a whole-codebase run, about 87% of the
narrow rules' findings were real, versus about 23% for the broad rule.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: michelletran-sentry

decisionModelLinter.config.ts

@@ -118,25 +118,79 @@ const audit = {
     'src/sentry/web/frontend/debug/**',
   ],
   rules: {
-    authChangeAuditTrail: {
+    rotatesSecretWithoutRecord: {
       prompt:
-        'Does the code change authentication or access state, and if so, does it record the change with create_audit_entry, create_audit_entry_from_user, create_system_audit_entry, log_service.record_audit_log, or capture_security_activity?',
+        'Does the code replace an existing client secret, signing secret, or webhook token with a new value at a user\'s request, such as rotating ApiApplication.client_secret or regenerating a project token? Generating a secret while installing an integration or creating a webhook subscription does not count. If so, does the same file record it with create_audit_entry, create_audit_entry_from_user, create_system_audit_entry, log_service.record_audit_log, capture_security_activity, or a sentry.audit logger (logging.getLogger("sentry.audit..."))?',
       values: [
         {
-          value: 'UNAUDITED',
+          value: 'TRUE',
+          description:
+            'The code assigns or updates a secret field with a newly generated value. Nothing in the file records it.',
+          severity: 'warn',
+          report:
+            'Record this change: org-level changes with create_audit_entry and an event from sentry/audit_log/register.py, user-level changes with capture_security_activity. If a function this code calls already records it, say so in the PR.',
+        },
+        {
+          value: 'FALSE',
+          description:
+            'No secret field gets a new value. Reading or comparing a secret does not count. Or the file records it.',
+        },
+      ],
+    },
+    issuesOrRevokesTokenWithoutRecord: {
+      prompt:
+        'Outside the OAuth flows for third-party apps (ApiGrant, ApiAuthorization, the authorize, consent, token, and authorizations endpoints, and Sentry App token exchange or refresh), does the code create, revoke, deactivate, or change the scopes of an ApiToken, OrgAuthToken, ApiKey, SentryAppInstallationToken, or an agent token grant? Authenticating a request with a token does not count. If so, does the same file record it with create_audit_entry, create_audit_entry_from_user, create_system_audit_entry, log_service.record_audit_log, capture_security_activity, or a sentry.audit logger (logging.getLogger("sentry.audit..."))?',
+      values: [
+        {
+          value: 'TRUE',
           description:
-            'The code creates, updates, or deletes auth state and nothing in the file records that action. Auth state is: member roles, team roles, invites, or adding and removing members; AuthProvider or SSO config; linking or unlinking an AuthIdentity; creating, rotating, or revoking an ApiToken, ApiKey, OrgAuthToken, or SentryAppInstallationToken; rotating a Sentry App client secret; 2FA authenticators; password, email, or primary email; superuser or staff grants; and org settings that require 2FA or email verification.',
+            'The code calls create, delete, or update on one of those token models (for example ApiToken.objects.create, token.delete(), update(date_deactivated=...), or update(scope_list=...)), or calls a function whose name says it grants token scopes (for example create_write_grant). Nothing in the file records it.',
           severity: 'warn',
           report:
-            'This changes auth or access state without recording it. Record org changes with create_audit_entry and an event from sentry/audit_log/register.py, and user changes such as password, email, or 2FA with capture_security_activity. If a helper this code calls already records it, say so in the PR.',
+            'Record this change: org-level changes with create_audit_entry and an event from sentry/audit_log/register.py, user-level changes with capture_security_activity. If a function this code calls already records it, say so in the PR.',
         },
         {
-          value: 'AUDITED',
-          description: 'The code changes auth state and the file records it.',
+          value: 'FALSE',
+          description:
+            'No such token is created, revoked, or rescoped. Authenticating with a token, updating last_used or date_last_used, and the OAuth authorize, consent, and token flows for third-party apps do not count. Or the file records it.',
         },
+      ],
+    },
+    changesPrivilegeWithoutRecord: {
+      prompt:
+        'Does the code grant or remove is_superuser, is_staff, or a UserPermission for a user? Organization and team roles are not privileges here. If so, does the same file record it with create_audit_entry, create_audit_entry_from_user, create_system_audit_entry, log_service.record_audit_log, capture_security_activity, or a sentry.audit logger (logging.getLogger("sentry.audit..."))?',
+      values: [
         {
-          value: 'NOT_AUTH',
-          description: 'The code does not change auth or access state.',
+          value: 'TRUE',
+          description:
+            'The code sets is_superuser or is_staff on a User, or creates or deletes a UserPermission, and no audit_logger.info(...) call on a sentry.audit logger follows it. Judge each separately: if is_superuser or is_staff changes and only the UserPermission change is recorded, answer TRUE. Nothing in the file records it.',
+          severity: 'warn',
+          report:
+            'Record this change: org-level changes with create_audit_entry and an event from sentry/audit_log/register.py, user-level changes with capture_security_activity. If a function this code calls already records it, say so in the PR.',
+        },
+        {
+          value: 'FALSE',
+          description:
+            'No privilege flag or UserPermission changes. Starting or ending a superuser or staff session, and checking whether a user has a privilege, do not count. Or the file records it.',
+        },
+      ],
+    },
+    changesAccountIdentityWithoutRecord: {
+      prompt:
+        'Does the code change a user\'s email or primary email, unlink or delete an AuthIdentity, or merge or delete user accounts? If so, does the same file record it with create_audit_entry, create_audit_entry_from_user, create_system_audit_entry, log_service.record_audit_log, capture_security_activity, or a sentry.audit logger (logging.getLogger("sentry.audit..."))?',
+      values: [
+        {
+          value: 'TRUE',
+          description:
+            'The code updates User.email or a UserEmail of an existing user, deletes an AuthIdentity, or merges or deletes User records. Setting the email of a new account being registered does not count. Nothing in the file records it.',
+          severity: 'warn',
+          report:
+            'Record this change: org-level changes with create_audit_entry and an event from sentry/audit_log/register.py, user-level changes with capture_security_activity. If a function this code calls already records it, say so in the PR.',
+        },
+        {
+          value: 'FALSE',
+          description:
+            'None of those change. Linking an identity through SSO setup, integration Identity links (Slack, MS Teams, Discord), verifying an email, and logging in do not count. Or the file records it.',
         },
       ],
     },