Audit log¶
A hash-chained, tamper-evident record of what was done and by whom: each entry carries the previous one's hash, so a selective change or deletion is detected — not prevented.
Who can read it
Administrators, the CISO, and the Auditor role — which reads this page and changes nothing anywhere. Before that role existed, opening the audit log to somebody meant also granting them the power to rewrite the policy they had come to check.
Why a chain¶
Each entry is chained to the one before it, so an entry cannot be altered or removed without breaking the chain from that point on.
A plain audit table records what happened, provided nobody with database access wanted it to say something else. A chain makes tampering evident, which is a materially different claim — and it is the claim an auditor, an insurer or a customer's security team is actually asking about.
The verification screen checks the chain and tells you where it breaks.
The mirror¶
Each entry is appended as one JSON line, outside the database it watches.
That is what closes the remaining gap. A chain inside the database detects tampering by anyone who cannot rewrite the whole chain; a second copy outside it detects tampering by someone who can. Point it at a path shipped to a log store you can append to but not edit.
Off means the log has one copy — and the verification screen says so, rather than implying a guarantee it cannot make.
What to check, and when¶
- After any unexpected privilege change.
- Before exporting compliance evidence.
- On a schedule, so the answer is not first sought on the day it matters.
Related¶
Users and teams · History and evidence — the triage record, which is a different document for a different question.