Why an audit log has to be append-only to be worth anything

Plenty of tools advertise an audit log. Far fewer can tell you what would happen if an administrator decided to change a row in it.

The distinction is not philosophical. A log that permits updates and deletes records intent, not history. Anyone reviewing it has to trust that nobody edited it, which is precisely the assumption an audit exists to remove.

Append-only means the database itself refuses. A trigger raises an exception on UPDATE and on DELETE, so the rejection happens below the application, below the API, and below whoever is signed in.

A useful entry captures five things: who acted, what object they touched, what action they took, when it happened, and from where. Drop any one of those and reconstructing an incident gets substantially harder.

Reads deserve logging too. In an inspection context, who looked at a document and when is often as interesting as who changed it.

None of this is a compliance certification, and it should not be described as one. It is the substrate that makes a future certification possible, and the thing that makes an internal investigation tractable today.