Immutable by the engine
Not a policy. A database trigger.
Updates and deletes on the audit log are rejected by the database itself. Every record carries a cryptographic link to its predecessor; the chain is verifiable on demand and exports are signed.
- Hash-chained records — verify the chain any time
- Every sign-in, decision, write and config change recorded
- Point-in-time answers: "why did X have Y at moment Z?"
the activity trail — filter, replay, export
