BIP 32 allows you to to implement the auditor use case:
Audits: N(m/*) In case an auditor needs full access to the list of incoming and outgoing payments, one can share all account public extended keys. This will allow the auditor to see all transactions from and to the wallet, in all accounts, but not a single secret key.
If I want all my bitcoin transactions to be fully audited, then I would need to give my auditor my master node details. However I obviously don't want to give him my master node secret key since he would be able to steal my money. Thus I could only give the auditor my master public key and the chain code. With that he will be able to derive all public keys and see all my transactions.
But that means that my entire tree can only use non-harded BIP-32. Is that correct or am I missing something?