The audit log matters more than the share link

Compliance reports go out as signed, expiring URLs, which is the obvious half. The half that actually gets asked about is who opened it and when. That is an inspector's question, months later, and the sharing mechanism alone cannot answer it.