Audit and evidence

Append-only is a claim about the application. Tamper-evident is a claim about anyone — including someone holding the database credentials.

Written from docs/adr/0004-audit-hash-chain.md — this page is written for an external reader rather than extracted verbatim

Every user action, configuration change and sensitive data access is written to an append-only audit table. The application role holds no UPDATE or DELETE grant on it. That makes the trail append-only, which is a statement about what the application does.

Canonical serialisationPermalink to this section

The payload serialisation is specified rather than left to the language: keys sorted lexicographically, no insignificant whitespace, timestamps as RFC 3339 in UTC at microsecond precision, null fields omitted. A digest that depended on a map's iteration order would not be a digest — it would be a value that changes for reasons unrelated to the data.

Per-tenant chainsPermalink to this section

Chains are per tenant. One institution's write rate does not couple to another's, and a tenant can be given an export of its own chain to verify independently — which is what makes the tamper-evidence claim checkable by the party who needs to rely on it, rather than assertable only by the vendor.

Sensitive accessPermalink to this section

Reading an encrypted identifier is itself an audited event. A reviewer can therefore ask not only what was changed but who looked at what, which is the question an examiner asks about a compliance system holding identity data.