The records nobody can edit

What is append-only

Four sets of records can be written to but never changed or removed.

• The audit log — who did what, to what, and when
• Complaint case history — every entry in a dispute timeline
• Account suspensions and reinstatements — both directions, each with its reason
• The accounting ledger

Why a trigger rather than a permission

Row-level security already gave ordinary users no way to update or delete an audit row. But those policies are bypassed by privileged connections — the service role, a direct database session, an automated job.

That gap was not theoretical. During an earlier build, automated agents cleaning up their own test data deleted the audit rows recording their actions, which is precisely the class of change an audit trail exists to make impossible. A database trigger fires for every role, including the service role and the table owner, so the hole is closed for good.

What this means for you

The history of a dispute is whatever actually happened, not whatever the current row says. Nobody holding the complaints queue can rewrite it afterwards.

The same applies to verification. Every check recorded, every approval, every refusal and every downgrade is written to the audit log with the officer's identity and their reason.

It applies to staff too

An administrator has more reach than an ordinary account, not more permission to erase. Administrators cannot delete audit entries, cannot edit a complaint's history, and cannot remove a suspension record — only add a reinstatement to it.

A suspension that could not be undone would be a deletion by another name, so reinstatement is recorded as its own event rather than by clearing a flag.