Most audit logs say what happened; almost none can say why it was allowed. The difference is the policy version and the approver, kept next to the event in the Audit Vault.
A verified identity on an unpatched laptop is still an exposure. These are the four posture checks worth enforcing for plant engineers, and how to roll them out without flooding the help desk.