Notes
Why an event log has to be append-only
An editable log is a document. An append-only log with attributed amendments is evidence. The difference matters when someone is asking questions under oath.
Details
- Last revised
- 12/02/2026
- Reading time
- 6 min
- Cost
- Free, no email required
Every control room product lets you correct a mistake. The question is what happens to the original.
The failure mode
Under pressure, entries are wrong: a wrong zone, a wrong time, a wrong call sign. Everyone accepts that. What destroys the record is fixing it silently afterwards, because there is then no way to show the record was not tidied to suit a conclusion.
What append-only means here
There is no update and no delete policy on log entries, and those permissions are revoked at database level. An application bug cannot rewrite a record because the database will not accept the write. A correction is a new row, attributed and timed, displayed beneath the original in time order.
The hash chain
Each audit row carries the hash of the row before it, so removing or altering a row breaks the chain. That does not make tampering impossible — it makes it detectable, which is the achievable goal.
The cost
A control room used to editing a spreadsheet finds this uncomfortable for about one event. Then someone gets challenged on an account, produces the original entry with the amendment underneath it, and the conversation ends there.
Read next
Or see it running
Vantra Control Room does all of this as a by-product of the shift, rather than as a document written afterwards.