Documentation / Platform glossary / Audit trail
An audit trail is a durable, tamper-resistant record of who did what, to what, and when. It differs from application logging in purpose: logs exist to diagnose software behaviour, whereas an audit trail exists as evidence that can be reviewed and relied upon afterwards.
An audit event answers a fixed set of questions: which actor performed the action, what action was taken, which object it affected, when it happened, and enough context to interpret it. An entry that records "record updated" without saying by whom or what changed is not usable evidence.
Two properties distinguish an audit trail from a log.
Immutability. Entries are append-only and cannot be edited or selectively deleted, including by administrators. A record that a privileged user can alter proves nothing about that user's actions, which is precisely the case an audit trail is most needed for.
Completeness for its declared scope. The trail must reliably capture every event in the categories it claims to cover. A trail that misses events under load is worse than none, because it invites false confidence in an absence of evidence.
Not everything belongs in it. An audit trail records significant actions — authentication, authorization changes, administrative configuration, access to sensitive records, and data modification. Recording every read of every page produces volume that makes review impractical, and the resulting noise defeats the purpose.
Audit trails support three distinct needs: periodic access review, incident investigation, and answering a customer's question about how their data was handled. Each depends on records that were captured before anyone knew they would be needed.
They are also frequently a compliance requirement. Most control frameworks expect evidence that privileged actions are recorded and reviewable, not merely that access is restricted.
QueryTek records meaningful administrative and user actions as immutable audit events scoped to a single tenant, so oversight and incident reconstruction do not depend on recollection. Event schemas, field names, and storage detail are not published.
