Audit Logging

Overview

A compliance audit log answers: who did what to which resource, when, from where, and with what result. It must also be tamper-evident, so an auditor can check that nobody edited or removed entries.

This skill puts the whole mechanism in PostgreSQL, so every application and every language gets it for free: a trigger links each row to the previous one by SHA-256, other triggers refuse UPDATE, DELETE and TRUNCATE, and one function re-checks the chain. The SQL below was run on PostgreSQL 18, including 40 concurrent inserts.

Retention floors to design for (confirm with your auditor, they depend on scope):

Instructions