IAL §9 · Tamper-evident audit log

Audit log

Every PHI access, every state transition, every external system call, every auth decision. Each row's log_hash is SHA-256(prev_log_hash || canonical_json(this_row)), forming a tamper-evident chain. Tampering with any historical row breaks every subsequent hash, detectable in O(n).

Entries (24h)

1,847

Hash chain

✓ Intact

PHI reads

412

PHI writes

183

External calls

274

Failed auth

Timestamp	Actor	Action	Resource	Detail	Hash chain
Apr 28 · 02:18:42 PM	System system	transition	integration_job job_01HZX7M8FRQ2Y6XN	submitted → in_progress (Anthem BH escalation auto-routed)	prev `8a1d44…` this `9f3c2e…`
Apr 28 · 02:14:08 PM	System system	create	operations_queue_ticket 01HZX7P5RDCFV6ZH	SLA monitor escalated stalled Anthem BH submission (47d in submitted)	prev `5b9e07…` this `8a1d44…`
Apr 28 · 11:42:11 AM	Patricia Yang (CVO) specialist	edit	operations_queue_ticket 01HZX7K3VNCP9TQA	Marked sub_task complete: 'Send verification request to CA BBS'	prev `3c8f12…` this `5b9e07…`
Apr 28 · 11:08:33 AM	Patricia Yang (CVO) specialist	create	audit_artifact ca-bbs-verify-request-2026-04-25.eml	Uploaded artifact (4.7 KB) to ticket 01HZX7K3VNCP9TQA	prev `7a4b91…` this `3c8f12…`
Apr 28 · 09:14:02 AM	agent_psv_state_board agent	external_call	state_board tx_lpc_board	Verified TX LPC license for A. Patel · returned status: active · confidence 0.994	prev `1f6c83…` this `7a4b91…`
Apr 28 · 09:13:47 AM	agent_psv_state_board agent	view	provider aisha-patel	Read provider.licenseStates, provider.npi for PSV	prev `4d2a59…` this `1f6c83…`
Apr 28 · 08:42:01 AM	Marisol Diaz user	auth	session sess_01HZX98...	Login successful · MFA challenge passed · IP 73.181.14.221	prev `9b8e22…` this `4d2a59…`
Apr 28 · 08:14:18 AM	Aisha Patel user	create	provider aisha-patel	Provider self-completed /intake/[token] flow · 5/5 steps · auto-CAQH consent: yes	prev `2e7f04…` this `9b8e22…`
Apr 28 · 08:14:18 AM	Aisha Patel user	auth	intake_token demo-aisha	Intake token validated · single-use · IP 99.34.121.57	prev `6c1a87…` this `2e7f04…`
Apr 28 · 08:14:02 AM	Aisha Patel user	edit	provider aisha-patel	Set credential, license_number, supervision_supervisor_id (3 fields)	prev `8d4f31…` this `6c1a87…`
Apr 28 · 08:13:59 AM	agent_intake_extract agent	external_call	anthropic_claude vision_v4	OCR + structured extraction of TX LPC license PNG (1.2 MB)	prev `f3a960…` this `8d4f31…`
Apr 27 · 09:14:37 AM	Avery Chen specialist	transition	integration_job job_01HZX7T7CG8ZR2NW	in_progress → completed (Optum credentialing committee scheduled May 7)	prev `5e2c14…` this `f3a960…`
Apr 27 · 09:14:37 AM	Avery Chen specialist	edit	operations_queue_ticket 01HZX7T8FVQ4DJK2	Set result = { committee_date: '2026-05-07', reference: 'OPT-2026-04-CR-92831' }	prev `1a7d28…` this `5e2c14…`
Apr 27 · 06:00:00 AM	agent_oig_screen agent	external_call	oig_leie monthly_2026_04	Bulk screened 214 providers · 0 hits	prev `3b9c51…` this `1a7d28…`
Apr 27 · 06:00:00 AM	agent_sam_screen agent	external_call	sam_gov monthly_2026_04	Bulk screened 214 providers · 0 hits	prev `8f6a09…` this `3b9c51…`
Apr 27 · 02:38:14 AM	System system	create	operations_queue_ticket 01HZX7U3HJ7BVKR2	Auto-created reference outreach ticket (Tier 4) for J. Williams from intake completion	prev `4e2d76…` this `8f6a09…`
Apr 26 · 11:42:38 AM	Aisha Patel user	create	supervision_log log_2026-04-26_aisha	Logged 24 hrs (16 direct, 6 group, 2 admin) · supervisor cosigned 11:42 AM	prev `7c3b81…` this `4e2d76…`
Apr 26 · 11:42:38 AM	Dr. Sarah Reyes user	edit	supervision_log log_2026-04-26_aisha	Cosigned supervision log · IP 73.181.14.221	prev `2a9d44…` this `7c3b81…`
Apr 25 · 04:13:09 PM	Marisol Diaz user	approve	integration_job job_01HZX7P0FZ5R8YT2	Approved Magellan enrollment draft for R. Bennett · queued for submission	prev `6f1e08…` this `2a9d44…`
Apr 25 · 09:43:21 AM	Rachel Bennett user	external_call	notarycam notary_appt_2026-04-30	Booked notary appointment Apr 30 11:00 AM via NotaryCam OAuth	prev `4b7c52…` this `6f1e08…`

How to verify the chain: recompute SHA-256(prev_log_hash || canonical_json(row)) for each row and compare against log_hash. Mismatches surface the exact row that was tampered with. Production: nightly background job verifies the entire chain and pages on-call if a break is detected.