What follows from it
Every event you emit is permanent. Which makes two decisions matter more than they otherwise would.
What goes in metadata. It is a free-form bag, it is returned by the detail read, and it is there forever. A resource name is fine. An email address is a choice you are making for the life of the deployment. A secret is a disclosure with no expiry.
How often you emit. An action worth recording is worth recording every time. An action you emit on every request because it seemed harmless is a table you will eventually have to deal with by hand.
The shape of the eventual answer
The append-only property is deliberate and will survive whatever pruning looks like: no management credential will ever be able to delete a row, because a credential that could erase an audit row could erase the evidence of its own use.
So pruning, when it lands, will be an operator-side sweep on an age policy — not a route.
What you can do now
Emit deliberately. The trail is for security-relevant actions: sign-ins, token refreshes, entitlement grants, admin changes, denials — logging is where the rest of what a run did belongs. It is not an application log, and the logging capability is where high-volume operational detail belongs.
Keep the metadata bag small and non-identifying. Codes and resource ids, not sentences and not addresses.
Watch the database. The trail defaults to DB — the reference names the binding and the table — the shared app database — so its growth is your application database’s growth. Pointing it at its own binding is possible today and is the isolation the follow-up would formalize.
Ask before you export. An exported trail carries project, environment and worker on each row precisely so an aggregate does not lose where a row came from — but it also carries whatever you put in metadata, to wherever you sent it.
Why it is a table and not a stream
An audit log is a query workload: by actor, by action, by time range, by resource, by outcome. KV is get-by-key only, and a log you cannot query is a log nobody reads.
Which is also why growth is a real consideration rather than a theoretical one — the value of the trail is in reading it, and a table too large to query has quietly stopped being an audit trail.