Audit Log Integrity Failure

Application traffic is fully healthy throughout — every uptime and latency dashboard reads green. But audit events are missing, duplicated, out of order, or partially unverifiable, following an upstream delivery degradation between the Event Stream and the Immutable Store. Six business invariants govern every decision: (1) audit evidence must be complete enough to establish who did what and when; (2) duplicate events must not silently count as multiple real actions; (3) missing events must not be fabricated; (4) ordering may be reconstructed only from trustworthy evidence; (5) immutable history must not be rewritten to make reports look clean; (6) a bounded reporting delay is acceptable if integrity is preserved. Decide whether to withhold the next scheduled compliance report until reconciliation finishes, or publish a bounded, honestly-flagged 'incomplete/unverified' status report instead; whether to actively reconcile the backlog, dedupe events by fingerprint, and reconstruct order from trustworthy source timestamps rather than raw arrival order; whether a secondary, independently-verified evidence source can legitimately close a real gap without fabricating anything; and — critically — whether publishing the next report 'as-is' is the operationally convenient choice it looks like, or a serious, permanent integrity violation.

Difficulty

Principal

Expected Time

~25 min

Category

Security & Identity