Audit Log Service  ·  View 39 of 40  ·  7 · Assurance

The Operators Are In Scope

Six attempts by six privileged insiders, and what each one actually meets — including the row where the residual risk is real.

Editable source SVG draw.io All views
The attempt What stops it What it leaves Detected within Residual Service operator Delete a segment Locked retention policy Refused delete, logged Immediate alert None Subscription owner Delete the container Policy outlives the owner Activity Log + our log ≤ 15 minutes Index can be destroyed rebuildable Custody engineer Rewrite a segment Create-only permission Chain diverges Next sweep or export Detection lag ≤ 7 d Checkpoint administrator Rewrite chain heads No segment access Heads vs segments differ On verification Needs the other admin Both administrators colluding Rewrite both sides External TSA token Token time mismatch On offline verify Phase 3 anchor closes it Authorised investigator Bulk-export a tenant Per-role export cap Watermarked export record Anomaly alert Read cannot be undone The Operators Are In Scope — What Each Attempt Actually Meets Bulk export is the realistic attack on a store that is otherwise hard to touch, and it is the one row where the residual risk is genuine: prevention caps the volume and detection names the exporter, but nothing puts read data back. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • The service's own operators are treated as an in-scope threat rather than an assumed-trusted party. This view is the test of whether the rest of the set was honest.
  • Prevention is not enough — tampering must be provable. Access control can be misconfigured; the chain exists so an external party can detect what access control failed to prevent.
  • The two administrator rows are separated deliberately: the segment administrator has no ledger access and the ledger administrator has no segment access, so the cheapest attack requires collusion.

Where it holds and where it does not

  • Segment deletion by any principal, including the subscription owner: prevented outright by the locked retention policy, and the attempt is alerted.
  • Two colluding administrators rewriting both segments and heads: caught by the external RFC 3161 token, whose time they cannot forge. Phase-3 witness anchoring closes this row properly.
  • Bulk export by an authorised investigator: capped and detected, never undone. This is the one row with a genuine residual, and it is the reason export volume is capped per role rather than merely logged.

Risks

  • Custody-plane segment rewriting is caught by chain divergence, but detection may lag by up to the seven-day sweep unless an export or on-demand verification touches the range sooner. A shorter sweep is a compute cost, and the number deserves review after the first year of real volume.
◀  Key Custody All views Named Failure Modes  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source39-insider-threat