5.2.14 Recommendation State Log Policy Reference
Source: app/plugins/Awards/src/Policy/RecommendationsStatesLogPolicy.php
RecommendationsStatesLogPolicy is a thin BasePolicy subclass for one state-history row. Standard entity actions are inherited.
State logs are audit data, not standalone domain records. Authorize access in the context of the parent recommendation and preserve the parent’s hidden/private/workflow visibility constraints. New mutations should be produced by RecommendationStateLogService, not by exposing generic add/edit/delete actions.
Tests should prove that an identity cannot gain access to a recommendation by querying its state log directly.