# GetAuditEntry

## Overview

GetAuditEntry retrieves a single audit entry by its unique identifier. Returns the full AuditEntry record including eventId, actor identity, entity reference, operation type, timestamp, and scope, or null if no matching entry exists.

This query requires the `viewAuditHistory` permission at the appropriate scope.

## Business Rules

- Lookup by `id` performs an exact UUID match
- Returns the full AuditEntry record including all fields
- Returns null when no matching entry is found
- Caller must hold `viewAuditHistory` permission at the appropriate scope
- A caller with company-scoped permission can only retrieve entries for their assigned companies
- A caller with global-scoped permission can retrieve global (company-unscoped) entries

## Process Flow

```mermaid
flowchart TD
    A[Receive lookup request] --> B{Caller has viewAuditHistory?}
    B -->|No| C[Return error: INSUFFICIENT_PERMISSION]
    B -->|Yes| D[Query AuditEntry by id]
    D --> E{Found?}
    E -->|Yes| F{Caller authorized for entry's scope?}
    F -->|No| G[Return error: UNAUTHORIZED]
    F -->|Yes| H[Return audit entry]
    E -->|No| I[Return null]
```

## External Dependencies

- None

## Error Scenarios

- **INSUFFICIENT_PERMISSION**: Caller lacks the required permission for this operation
- **UNAUTHORIZED**: Caller's permission scope does not cover the target resource

## Test Cases

- returns audit entry when found by id
- returns null when audit entry not found
- returns entry with all fields populated
- returns company-scoped entry when caller has matching company permission
- returns global entry when caller has global-scoped permission
- rejects when caller lacks viewAuditHistory permission
- rejects when caller lacks permission for entry's company scope
