Your admins can delete the audit logs covering their own actions. How do you make the trail tamper-evident?

Tamper evidence is an architecture property, not a log setting. Off-box forwarding, append-only storage under separate credentials, hash chains and a verification job that actually runs.

Grounded in researched DevOps, SRE and platform engineering interview loops, written to a senior-engineer editorial bar, and never padded to hit a word count.