# Design a tamper-evident audit logging system: system design interview question

> Sensitive action records need durable transfer, trusted query results, tenant access checks, and long retention.

Source: https://sysround.com/questions/design-tamper-evident-audit-logging-system
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a system that records sensitive administrative and user actions across services. Auditors need records they can trust. The system must not significantly delay application requests."

## What to clarify first

- Scale
- Read and write mix
- Event contents
- Source boundary
- Latency and freshness
- Consistency, durability, and outages
- Threat model
- Access
- Retention
- Interview boundary

## Scope of a strong answer

Core requirements:

- Collect events from an existing durable source journal
- Search and export records within the caller's permitted tenant scope
- Expose changes and omissions in results for accepted records
- Protect authoritative records from early deletion for seven years

Usually out of scope:

- Design the source transaction that captures each action
- Support legal holds or a fixed deletion deadline
- Provide cross-region disaster recovery
- Search full request bodies or replace application debug logs

## What interviewers probe

### Trust in query results

Valid returned records do not prove a complete result. A hostile search database can hide every matching record without changing the remaining records.

### Records during an outage

A fast asynchronous path needs finite durable capacity. Each handoff must preserve records until the next copy and its evidence become durable.

### Access to records

Queries and exports expose sensitive facts across tenants. A worker's broad service role must not become the caller's access scope.

## Common mistakes

- Treat a mutable search database as the authoritative record set
- Verify returned records without checking result coverage
- Trust mutable counts or empty search results as evidence of absence
- Describe pending or failed verification as a complete result
- Expire unarchived log records because a timer ends
- Check query access but leave exports or downloads outside those checks

## The bar by level

- **Senior:** Connects durable handoffs, tenant checks, and locked retention. Defines verified query membership and coverage. Calculates one relevant budget. Examines one optional area if time permits.
- **Staff+:** Defines exact snapshot and checkpoint limits. Explains partial exports and hostile index results. Compares verified scans with stronger index evidence. Examines one selected failure boundary without requiring every extension.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=audit-logging


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.