[rules-dev] audit logging: better describe facts