Most audit trails are rows in a table the operator can edit. That gap stays invisible until the day it matters — and by then the log is all anyone has.
