Auditing every I/O is not really reasonable. If you need that level of auditing, then build it into your applications and build a proper cryptographic audit trail protocol.
you want your kernel to do that because it's the source of truth. And what if you want to audit execution that includes binary blobs you don't own the source of?