RBAC prevents an unauthorized action from happening. Falco detects abnormal behavior while it’s happening. Neither answers a question that comes up systematically after a security incident: who, precisely, did what, when, and under which identity. Without an Audit Policy enabled on the API server, that question simply has no answer, no matter how good the rest of the security posture is.

What the API server records, on request only

Every request to the Kubernetes API server (creating a pod, reading a Secret, deleting a namespace) can be logged, but nothing gets recorded by default: an explicit Audit Policy defines which requests to log and at what level of detail.

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["secrets"]

Without this policy, accessing a sensitive Secret (a successful get, a full content read) leaves absolutely no usable trace afterward: the question “who read this Secret last week” has no answer if nobody enabled audit logging before the question came up.

Four levels, a volume-vs-detail trade-off

None records nothing for the concerned requests. Metadata records who made the request, when, on which resource, but never the request or response content. Request adds the request content (useful for knowing what was asked for), without the response. RequestResponse records everything, including the full response content, the most expensive level in log volume.

# Metadata is enough for most resources:
# who, when, what, without the full content
- level: Metadata
  resources:
    - group: ""
      resources: ["pods", "deployments"]
# RequestResponse reserved for truly sensitive resources,
# full content is expensive in volume
- level: RequestResponse
  resources:
    - group: ""
      resources: ["secrets"]

Applying RequestResponse to every resource in the cluster generates a log volume that quickly becomes unmanageable and expensive to store: the policy gets built resource by resource, reserving the most detailed level for objects that genuinely justify the cost (Secrets, RBAC, security-related resources), Metadata being enough for the rest.

What sets the audit log apart from everything else

RBAC answers “was this action authorized?”, always before it happens. Falco answers “is this runtime behavior abnormal?”, in real time. The audit log answers a question distinct from both: “what actually happened, historically, via the API?”, an immutable trace once written, consulted after the fact, often days or weeks later, when nobody was even asking the question at the time.

# Querying the audit log after the fact, for a question
# nobody had anticipated at the time
grep '"verb":"get".*"resource":"secrets"' audit.log | jq .user.username

Takeaway

RBAC prevents, Falco detects live, audit logging answers after the fact a question neither covers: who did what, precisely, via the API. Without an explicit Audit Policy (nothing gets logged by default), that question stays unanswered, no matter how good the rest of the deployed security is. The detail level (Metadata to RequestResponse) gets chosen resource by resource, reserving full-detail cost for objects that justify it, one of the pieces that completes reliability and observability covering security beyond prevention alone.