Audit trails versus access logs
Why do audit trails and usage logs have opposite requirements?
These look like the same artifact and have opposite requirements.
| Telemetry (access log for ranking) | Audit trail | |
|---|---|---|
| Purpose | ranking, trends | evidence |
| Can be sampled or rolled up? | Yes; a few percent error does not matter | No; must be complete |
| Tamper-evidence | not needed | required, against someone who wants to hide what they did (non-repudiation is security's subject) |
| Retention | weeks to months | years, often under legal hold (a legal order to keep records) |
Mixing them means paying evidence-grade storage and integrity costs for ranking-grade data, which is a common and large bill.
One hard limit: audit granularity cannot go below the query. Logging each row touched by a scan of one billion rows would cost more than the scan. So "who saw this record?" is always a reconstruction from query conditions applied to data snapshots. That is inference, not evidence, and any process that depends on it should say so.
Telemetry may be sampled. Audit may not. And no audit log can honestly answer a per-row question.