Build Tamper-Evident Run Logs: One ID, Full Audit Trail

Build Tamper-Evident Run Logs: One ID, Full Audit Trail

The Problem: Proving What Happened



Someone in the community lost a fintech contract because they couldn't prove what their automation did on March 12th. Make showed a green checkmark. That's it. No details, no export, no chain of evidence.



The question isn't "did it fail." The question is "prove what happened." Step by step. With timestamps. With evidence you can hand to someone who doesn't trust you yet.

The Solution: One Pattern, Three Pieces




1. Correlation ID - One identifier generated at the trigger, propagated through every step


2. Append-only log - Structured records that can't be modified after creation


3. Export path - CSV/JSON evidence you can hand to auditors




This follows the W3C Trace Context spec - the same standard OpenTelemetry uses, the same one AWS X-Ray adopted in 2023.

Implementation Options

Airtable: Permissions + Interfaces




• Table-level create/delete restrictions


• Field-level edit permissions


• Interface Designer for create-only forms


• CSV export by correlation ID


• Enterprise audit log export


• Setup time: ~20 minutes


Notion: Integration-Only Writes




• Internal integration with Update/Insert capabilities


• Human users get view/comment access only


• Version history on paid plans


• Enterprise audit log CSV export


• Setup time: ~15 minutes


• Limitation: Not cryptographically tamper-evident


Postgres/Supabase: Hash-Chained Evidence




• Row Level Security (INSERT only, no UPDATE/DELETE)


• BEFORE INSERT trigger with SHA-256 hash chaining


• pgcrypto extension for cryptographic functions


• Advisory locks prevent concurrency issues


• Setup time: ~45 minutes


• Capability: Tamper detection (not prevention)


The Slack Command



Build a /what-happened slash command that:




• Takes a correlation ID as input


• Queries your log in under 3 seconds


• Returns step count, duration, status, and recent events


• Opens a modal for full timeline view


• Generates signed CSV download links


Honest Limits




• Airtable/Notion: Operational append-only, good for most security reviews, but privileged admins could still modify data


• Postgres hash-chaining: Detects tampering but doesn't prevent it - superuser access could rewrite the entire chain


• External anchoring: For regulated industries, compute daily hashes over chain heads and write to separate systems (S3 Object Lock, different database)


This Week's Action



Pick your current stack and set up the run log table with correlation ID field. Just the table. Just the permissions. Get the log writing first - everything else clicks into place once you can see every run as a chain of timestamped events.

Resources




• Run Log Kit: Field schemas for all three stacks, Postgres SQL with hash-chain triggers and RLS policies, Slack endpoint contract


• W3C Trace Context Spec: Standard for correlation ID propagation


• OpenTelemetry Context Propagation: Implementation guidance for trace IDs





Transform invisible automation work into provable infrastructure your clients can rely on.

Видео Build Tamper-Evident Run Logs: One ID, Full Audit Trail канала Headcount Zero