Audit log

Append-only. Every privileged action, with the actor and the state on both sides of it.