The question behind the term
Ordinary logs answer operational questions; an audit trail answers who accessed or changed sensitive state under which authority. Copying patient content or secrets into either system creates a second uncontrolled disclosure surface.
A reviewable approach
Record opaque resource references, actor, purpose, policy decision, outcome, time and correlation. Append evidence before returning a sensitive result, prevent normal runtime mutation and verify each tenant’s sequence and integrity chain.
- Minimize the event body
- Audit denied and successful sensitive actions
- Separate audit reader from application runtime
- Define corrections as new entries
The boundary to keep visible
A hash chain is tamper-evident, not tamper-proof. Database owners can replace state unless checkpoints, access separation, backups and independent reconciliation extend the boundary.