Audit Log Service  ·  View 06 of 40  ·  2 · People and journeys

Journey — Verify Without Trusting the Operator

The only journey in the set whose best moment happens offline, on a machine this organisation does not run.

Editable source SVG draw.io All views
External Auditor Appointed by the regulator Goal — Satisfy myself that the record could not have been altered, on evidence I can check myself Trigger — The annual controls audit, plus one range subpoenaed under litigation Done when — A signed opinion that the range is intact — or a named, dated divergence 1 · Request names a range 2 · Receive the bundle 3 · Verify offline ◆ moment of truth 4 · Challenge ◆ moment of truth 5 · Conclude opinion issued What they do Names tenant + range Takes the bundle Runs the verifier Checks the anchor Asks about a gap Signs the opinion Where they do it Evidence request Signed bundle audit-verify CLI Disposal certificate Opinion letter Behind the glass Export service Proof service Published key Tombstone record How it feels Satisfied Working Sceptical Where it hurts Trusts nothing said Whose key is this? A gap reads as tamper What answers it Bundle self-contained Third-party anchor Lawfully disposed No service call made External Auditor — Verify Without Trusting the Operator The only phase that rises is the one performed offline. Everything the service says about itself is discounted; what carries the audit is a bundle that verifies with a published algorithm and a public key. Views 24 and 30. v 1.0 · owner Data & AI Global Practice · date 2026-09

The trough, and its answer

  • The low point is Challenge: the auditor hits a range where records have been disposed of, and a gap in a hash chain is indistinguishable from a deletion unless the design anticipated it.
  • Answered by the tombstone: the segment bytes go, the Merkle root and the signed disposal certificate stay in the chain, and verification reports 'lawfully disposed under certificate X' rather than 'broken here'. Views 16 and 25.
  • The rising phase is Verify offline, because it is the only one that does not depend on this organisation being honest.

What makes the bundle stand alone

  • Records, covering checkpoints, inclusion proofs, segment hashes and the export's own manifest, signed by a key whose public half is published and anchored.
  • A published algorithm and a single-binary verifier, so the auditor runs it on an air-gapped laptop and contacts nothing.
  • Phase 3 adds a third-party witness anchor, which removes the last dependency on this organisation entirely.

Risks

  • Until the witness anchor ships, 'whose key is this?' is answered by our own key transparency record and the external TSA countersignature. That is strong, and it is not the same as an independent witness.
◀  Journey — Trace an Account Through Thirteen Months All views Journey — Emit Without Inheriting Our Outage  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source06-journey-external-auditor