B7What the client asks
“Who changed this?”
Not a timeline that anyone with database access can quietly edit. An append-only record of every write, and a way to prove it has not been touched.
What actually goes wrong
An audit table that can be updated is a log that proves nothing. The question behind the question is whether the record can be trusted by somebody who does not trust you.
The usual implementation is a trigger writing to a table that the same database user can edit, which answers the easy version of the question and not the real one.
What Grit does about it
- Writes are recorded through the event bus, so adding an audited action is not a line somebody has to remember to add to a handler.
- The log is hash-chained and append-only, enforced by the routes, by a GORM guard and by a database trigger, and it has a verify action.
- Resources can be append-only themselves, and reads of sensitive resources can be recorded too.
The commands
A ledger that cannot be edited or deleted
grit generate resource LedgerEntry --append-only --fields "kind:string, amount:money"
Record who read it, as well as who wrote it
grit generate resource Record --audit-reads --fields "subject:string, notes:text"
What it does not do
It proves the chain has not been altered. It cannot prove that what was written was true, and somebody with the server can still stop the process.