Re: web app security - user profile or validation list?

If it was me and the journaling was the item of interest, I would
investigate what additional data I can put into the journal to further
break down the transactions.

If all online transactions are done under a specific profile then that
tells me that it was done by a "non i" user.

Perhaps there is some opportunity with (for example) the job accounting
code or something similar to inject some metadata into the journal entries.

Slightly off-topic perhaps but I have been reading a lot of Steve's
reponses as a need to identify journal transactiosn being pushed out to the
authentication method.