Audit logs are immutable

PCI-DSS Req 10.3.2 explicitly requires that audit log files be protected to prevent unauthorized modifications. NIST AU-9 requires protection of audit information from unauthorized access, modification, and deletion. An audit log a privileged user or a compromised service account can modify is not a trustworthy audit trail — an attacker who can delete audit events covering their tracks has neutralized your forensic capability entirely. SOC 2 CC7.2 requires integrity controls on security-relevant records. The most common failure mode is an audit_events table created with the same full-CRUD RLS policy as application tables, making its records as mutable as any other data in the system.

Restrict the audit_events table to INSERT-only at the database level so no application code path — including a compromised service account — can modify or delete records.

For Supabase, create an INSERT-only RLS policy and explicitly omit UPDATE/DELETE:

-- Allow authenticated users to insert their own audit events
CREATE POLICY "audit_insert_only" ON audit_events
  FOR INSERT TO authenticated
  WITH CHECK (actor_id = auth.uid());

-- No UPDATE or DELETE policy — Postgres denies by default under RLS
-- Service role inserts via server-side API (bypasses RLS as expected)

Alternatively, route audit events to an external append-only log service (Better Stack Logs, Axiom, AWS CloudWatch) — these are immutable by design and require no additional database policy work.