Why a key log has to be append-only

Every key log starts with good intentions. A spreadsheet, a shared tab, a column for “who has it.” Then a key goes missing, someone tidies the sheet, and the one row that mattered is gone — not maliciously, just helpfully.

That’s the whole problem. A record you can quietly edit is a record no one can lean on. When an owner disputes an entry or an examiner asks who held the vault key in March, “here’s our spreadsheet” invites the obvious question: what did it say before you cleaned it up?

Corrections, not edits

KeyCustody’s ledger is append-only. You can’t change or delete an event. If something was logged wrong, you record a correction — a new, timestamped entry that references the original. The mistake stays visible; so does the fix.

This feels heavier than a spreadsheet for about a day. Then it becomes the reason the record is worth keeping: nothing disappears, so nothing is in doubt.

What that buys you

• A dispute takes seconds, not an afternoon. The timeline is the answer.
• Separations are clean. Retire access the day someone leaves, and the proof is already written.
• Audits stop being events. The history examiners want is the history you’re already keeping.

Append-only isn’t a feature we bolted on. It’s the point of the whole thing.