What goes wrong with “Removal audit chain” in a shop, considering someone who recomputes the whole chain can rewrite history?

Each removal decision is written to a local log in which every entry commits to the previous one, and the current state is cross-checked against the chain. It is tamper-evident, not tamper-proof; publishing the head hash outside the computer (for example in a printed or exported record) is a planned mitigation. Plan for: someone who recomputes the whole chain can rewrite history; no trusted time offline; local only. It exists only as a file in the repository, not as a product feature.

Go to the related page

How to read this

The tag above says how real the answer is. Answers describe the plan in the repository and design documents. No app is released. Where an answer touches tax or law, treat it as a theme to verify with a qualified local adviser.

More in Security and privacy

• Which edge cases come up around “Staging discipline”, thinking about rollout tooling not built?
• See it in context with the whole topic
• Search all answers