Append-Only Audit Log

A conventional audit log is a table like any other: rows can, in principle, be updated or deleted by anyone with sufficient database access, including an insider or an attacker who has compromised admin credentials. That means the log's trustworthiness ultimately rests on nobody misusing that access — a claim that's hard to verify after the fact and easy to violate quietly.

An append-only log removes the "update" and "delete" operations from the equation entirely, usually by enforcing INSERT-only access at the database-role level rather than trusting application code to behave. Once a record is written, no credential the application holds can alter or remove it — only a genuinely separate, more privileged operation (if one exists at all) could, and that operation itself would be logged.

Hash-chaining strengthens the guarantee further: each new entry includes a hash of the previous entry, so the entries form a chain where altering any historical record — even via a privileged bypass — would break the chain and be detectable. Together, append-only enforcement and hash-chaining turn "we have an audit log" into a claim you can actually verify rather than one you have to take on trust.