mediumDesignConceptScenarioMidSeniorStaff
How do you design a system so an auditor can prove who accessed a record and why?
8 min readUpdated 2026-08-15
Answer
Short answer
You need a purpose-built audit trail, not application logs: guaranteed-capture, append-only records of actor, subject identifier, action, server time, outcome and stated purpose, made tamper-evident by hash chaining and anchored write-only storage, and held where whoever can change the data cannot change its record.
Was this answer helpful?
Likely follow-ups
- How do you satisfy an erasure request for a subject who appears throughout the audit trail?
- Where do you enforce audit capture so an application cannot silently skip it?
- How do you audit reads of the audit trail itself without recursing forever?
- What does a break-glass access flow look like, and who reviews it afterwards?
- How would you demonstrate to an auditor that no records are missing, rather than that the ones present are intact?
Related questions
- A release goes out and afterwards users can see records they were never entitled to. How would you find out, and how long would it take?hardAlso on access-control and separation-of-duties6 min
- A legal hold lands on Friday afternoon and your nightly deletion jobs run at two. What do you do, and what do you build afterwards?hardAlso on retention and audit-trail6 min
- How do you handle personal data in prompts, logs and traces for an LLM feature?mediumAlso on retention5 min
- What does least privilege look like in practice, and what is separation of duties there to prevent?mediumAlso on separation-of-duties6 min