Status: IN
The `auid` (Audit UID / loginuid) is assigned at login and inherited across `su`/`sudo`, tracking the original login identity for accountability.
Source: repo:entries/2026/03/04/en-documentation-red_hat_enterprise_linux-9-html-security_hardening-auditing-the.md