Why audit entries cannot be edited or deleted
The audit trail in MobilityManager is append-only: entries can be read, but never edited or deleted through the platform. This immutability is what makes the trail trustworthy as compliance evidence. This article explains how the platform enforces it and the one narrow exception that exists for GDPR.
Required permission
Reading audit entries requires the settings:view permission. There is no permission that grants the ability to change or remove them — those operations are not available to anyone.
Why the trail is immutable
An audit trail only has value if it cannot be tampered with. If a user could edit or delete entries, they could hide their own actions, and the trail could no longer prove what happened. By making the trail append-only, MobilityManager guarantees that once a change is recorded, the record of that change stays intact.
How it is enforced
Attempts to modify the audit trail are actively rejected:
| Attempt | Result |
|---|---|
Edit an audit entry (PUT /api/audit/{id}) | Blocked with "Audit entries are immutable and cannot be modified" and the attempt is logged. |
Delete an audit entry (DELETE /api/audit/{id}) | Blocked with "Audit entries are immutable and cannot be deleted" and the attempt is logged. |
The underlying audit table is itself append-only, so the trail is protected at both the interface and the data layer.
Note: The audit trail does not audit itself. Because entries can never change, there is no need to record changes to them — and this also prevents an endless loop of audit-on-audit entries.
The one exception: GDPR pseudonymization
GDPR's right to erasure requires removing a person's identity even from historical records. To reconcile this with immutability, pseudonymization makes the single minimal change it is allowed to: it replaces the UserEmail on that person's past audit entries with a pseudonym such as Deleted User #00042-58391. Every other field — timestamp, action, entity type, entity ID, and the recorded values — is preserved. The structure of the trail stays intact; only the personal identifier is removed.
Tip: Scheduled data-retention runs may purge entries older than your retention window. That is a governed, logged process — not ad-hoc deletion — and it is separate from the blocked manual delete described above.
Related
- The audit trail and what it captures
- Retention and compliance reporting
- Pseudonymize a user (GDPR right to erasure)
- View and filter audit entries
