Design a scalable audit pipeline capturing every authentication and authorization event across a microservices platform for compliance and anomaly detection.

Have every service publish AuthenticationSuccessEvent/failure events and AuthorizationDeniedEvent (Chapters 5 and 9) to a central message stream (e.g., Kafka) rather than writing directly to a shared database from every service. A downstream consumer aggregates these into a queryable audit store, feeding both compliance reporting (who accessed what, when) and real-time anomaly detection (e.g., alerting on a spike of AuthorizationDeniedEvents for one user, suggesting probing or a compromised, downgraded-privilege account).