docs: function ImmutableAccessControlAudit (args) {
      // require access control id
      assert.ok(defined(args.accessControlId), 'accessControlId required')
      // require valid allow type
      assert.ok(defined(validAllowTypes[args.allowType]), `invalid allowType ${args.allowType}`)
      // initialize aduit record
      this.accessControlId = args.accessControlId
      this.allowArgs = args.allowArgs
      this.allowType = args.allowType
      // list of evaluated rules
      this.rules = []
      // optional boolean for whether or not access allowed
      this.allow = undefined
      // optional scope that access allowed for
      this.scope = undefined
      // set to true when allow request resolved
      this.complete = false
  }