The trust problem
An append-only table, restricted role, or managed logging service can improve control. Yet the investigator still depends on the producer, its live database, and its current permissions. A stronger design chains events cryptographically, signs checkpoints, and makes verification portable.
What the verifier should test
A useful verifier checks sequence, event hashes, chain linkage, signatures, trusted keys, and the stated anchor. It should operate on an exported evidence bundle without calling the production service. A missing or altered event must make verification fail visibly.
Receipts connect evidence to action
A receipt gives the calling workflow a durable handle for disclosure, denial, deletion, or administrative change. The audit chain gives investigators system history. Together, they connect the immediate outcome to a sequence that can be independently checked.
The honest boundary
Cryptographic evidence does not prove every business statement is true. It proves the captured sequence has the expected integrity properties under the trusted-key posture. Completeness still depends on routing relevant operations through the governed system and protecting the signing boundary.