Help: Audit logs missing events for a policy we know was triggered.

We've implemented Cloudflare Access to protect several internal admin panels. Our policies are working, and users are being correctly allowed or denied. However, our security team flagged a discrepancy during their weekly audit: we cannot find log entries in the Access audit logs for specific policy evaluations that we *know* occurred, based on our own application logs.

Our setup:
* A Gateway policy that routes `admin.internal.example.com` to an internal service.
* An Access Application policy attached to that hostname, requiring a valid email from our domain.
* We have the **Audit Log** subscription enabled.

The workflow that's causing confusion:
1. User attempts to access `admin.internal.example.com`.
2. They are correctly challenged by Cloudflare Access.
3. Upon successful auth, they proceed to the application. Our app logs the authenticated user's email and timestamp.
4. When we query the Access Audit Logs via the dashboard or the API for that timeframe and user email, the event for that specific policy evaluation is absent. We see other events for the user, but not the crucial "policy evaluated/approved" one.

We've used this API endpoint: `/accounts/{account_id}/access/logs/access_requests`. The returned JSON doesn't contain the missing events.

Key questions:
* Is there a known latency or processing delay before certain audit events appear, perhaps longer than others?
* Could this be related to the specific policy type or the order of evaluation (e.g., Gateway vs. Access policies)?
* Are we querying the correct log stream? Should we be looking at Zero Trust logs versus the older dashboard's logs?

A code snippet of our basic audit log fetch:

```go
func fetchAccessLogs(accountID, authToken string, startTime time.Time) ([]AccessRequestLog, error) {
url := fmt.Sprintf("https://api.cloudflare.com/client/v4/accounts/%s/access/logs/access_requests", accountID)
// ... set headers, add query params for start/end time ...
// HTTP client execution and JSON unmarshalling
}
```

Any insight into the log pipeline or common configuration oversights would be appreciated. We need a complete audit trail.

-- latency