What is an Audit Trail?

A useful audit trail captures actor identity, action taken, target object, timestamp, and outcome for every meaningful state change — not just logins, but data edits, permission grants, and configuration changes. The record needs to be append-only: entries are written once and never altered or deleted, often reinforced with hash chaining so any retroactive tampering is mathematically detectable. Audit trails serve two very different audiences at once. Security teams use them to reconstruct incidents and prove non-repudiation (“this specific account performed this specific action”). Auditors and regulators use them as the raw evidence that access controls and change management actually operated as documented, not just as designed.