code: private void authorize(HttpSession session, Action action, Entity entity, String location)
              throws AuthorizationException, DataAccessException {
          AuthenticatedUser user  = (AuthenticatedUser)session.getAttribute("authenticatedUser");
          if (user == null && ApplicationContext.getServiceUser() != null) {
              String cuid = ApplicationContext.getServiceUser();
              user = new AuthenticatedUser(UserGroupCache.getUser(cuid));
          }
  
          if (user == null)
              throw new AuthorizationException(AuthorizationException.NOT_AUTHORIZED, "Authentication failure");
          if (action == Action.Create || action == Action.Delete) {
              if (!user.hasRole(Role.PROCESS_EXECUTION)) {
                  throw new AuthorizationException(AuthorizationException.FORBIDDEN, "User "
                          + user.getCuid() + " not authorized for " + action + " on " + location);
              }
              logger.info("Asset mod request received from user: " + user.getCuid() + " for: " + location);
              UserAction userAction = new UserAction(user.getCuid(), action, entity, 0L, location);
              userAction.setSource(getClass().getSimpleName());
              ServiceLocator.getUserServices().auditLog(userAction);
          }
      }
docs: Also audit logs create and delete.