Audit Trail Record¶
Audit log — instantiates Traceability Linking
Records who created, changed, approved, accessed, or retired each record and link, and when, in an append-only tamper-evident history — so the traceability system itself can be reviewed and trusted.
Trace links are only trustworthy if their own history is trustworthy. An Audit Trail Record is the meta-mechanism that watches the linking system: it does not create trace links or say what they mean — it records the operations performed on records and links. Every create, change, approval, access, and retirement is captured with its actor, timestamp, and the version affected, appended to a log that cannot be quietly rewritten. Where a decision log records decisions and a citation chain records support, this records the history of the linking itself, so a reviewer can ask "who changed this link, and when?" and get an answer that holds up as evidence. It is deliberately narrow: it preserves history, and leaves the meaning of the links and the rules for what must be linked to other mechanisms.
Example¶
A hospital's records system must be able to show, after the fact, exactly who touched a patient chart. Every time a clinician opens the record, edits a field, or re-links it to another document, the Audit Trail Record appends an event: actor, action, timestamp, and the version of the record before and after. The log is append-only and tamper-evident, so an entry cannot be silently removed to hide an access.
Months later a privacy complaint alleges a staff member viewed a chart they had no business seeing. The trail settles it in minutes — it shows the access, the time, and that nothing in the log was altered afterward. Because the history itself is protected, the log is admissible as evidence of what happened, rather than a list of claims about it.
How it works¶
Its substance is a time-ordered, append-only stream of events about other things — links and records — never an editable current-state view. Three properties distinguish it: every event is actor-attributed and timestamped, so responsibility and sequence are recoverable; every event fixes the version and status of the thing before and after, so history is not misread as if the past looked like the present; and the log is tamper-evident — typically hash-chained or on write-once storage — so a reviewer can trust that the recorded history has not itself been edited. It answers what happened to the links, not what the links mean.
Tuning parameters¶
- Capture scope — which events are logged (writes only, or reads and views too). Capturing access catches privacy misuse but multiplies volume; write-only is cheaper but blind to who looked.
- Tamper-evidence strength — plain log versus cryptographic hash-chaining versus write-once (WORM) storage. Stronger schemes make the history itself trustworthy but cost storage and complexity.
- Retention window — how long events are kept. Longer supports late audits and legal holds; shorter limits liability and cost.
- Attribution granularity — individual actor versus role or service account. Individual attribution supports accountability but raises surveillance and privacy stakes.
- Alerting — whether anomalous events (unusual access, out-of-hours edits) trigger notice, turning a passive log into an active tripwire.
When it helps, and when it misleads¶
Its strength is accountability and reconstruction: it makes the linking system reviewable, supports non-repudiation — a party cannot credibly deny an action the trail records[n1] — and lets an investigator replay exactly how the current state was reached.
Its failure modes come from mistaking the log for more than a record of events. A trail that nobody ever reviews provides false assurance — "we have an audit trail" is cited as evidence of control while the log goes unread, which is the classic misuse. Over-broad capture buries the signal in noise until the one event that matters is unfindable. If the log is editable, it proves nothing, because the history it claims to preserve could have been curated. And crucially, it records that a link was changed by whom and when — not whether the change was correct or the link meaningful. The discipline that keeps it honest is to make it genuinely append-only and tamper-evident, scope capture to what will actually be examined, and review it — an unreviewed trail is theater.
How it implements the components¶
audit_trail— its entire substance: the preserved history of how links and records were created, changed, approved, accessed, and retired.version_anchor— each event fixes the version, status, and timestamp under which a link or record was valid, so the recorded history is not misread against the present state.
It does not define what the links mean (link_semantics — Citation Chain) or which links must exist (coverage_rule — Traceability Dashboard); it records the operations performed on links that other mechanisms create.
Related¶
- Instantiates: Traceability Linking — the Audit Trail Record supplies the history strand that makes the trace network itself reviewable.
- Sibling mechanisms: Decision Log · Data Lineage Record · Citation Chain · Change Impact Report · Requirements Traceability Matrix · Chain-of-Custody Record · Source Control Linkage · Test Coverage Link · Traceability Dashboard
Editorial Notes¶
Form Classification¶
Form family: Record, Log & Register
Rationale: Records who created, changed, approved, accessed, or retired each record and link, and when, in an append-only tamper-evident history — so the traceability system itself can be reviewed and trusted, making its operative form a durable account of actual events, decisions, or transitions whose value depends on history or provenance.
Independent corroboration: The frozen evidence defines Audit Trail Record as 'Records who created, changed, approved, accessed, or retired each record and link, and when, in an append-only tamper-evident history — so the traceability system itself can be reviewed and trusted', so its operative form is Record, Log & Register.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Accounting & Auditing
Origin pattern: Convergent development
Present-day reach: Multi-domain
Rationale: Audit trails originated as attributable histories of who created, changed, approved, and retired records.
Related originating lineages:
- Computer Science & Software Engineering — Tamper-evident append-only logging implements versioned record and link histories.
- Library & Information Science — Archival provenance and record lifecycle practice govern trustworthy documentary traces.
Review outcome: Independent reviewer agreement; high confidence.
Notes¶
An audit trail is evidence of history, not of correctness. It can prove a link was changed, by whom, and when — but it cannot show that the link is meaningful, complete, or right. Pairing it with a mechanism that governs link semantics and coverage is what turns "we can see what happened" into "we can trust what the links say."
[n1] Non-repudiation is the property that an actor cannot plausibly deny having performed a recorded action. A tamper-evident, actor-attributed log is the standard means of achieving it, which is why append-only construction and integrity protection are not optional refinements but the point. ↩