Stop Trusting the App: Enforcing Append-Only at the Database Layer

Most "audit logs" are append-only by convention, not by enforcement. The application inserts a row and politely promises never to UPDATE or DELETE it. That promise holds right up until the moment someone does one of these: A bug in the app calls repo.delete(id) on the wrong entity. An operator connects with psql and runs a cleanup script against...