Ask how change accountability works in most engineering organizations and the answer rests on one foundation: personalized logins. Every change traces to an account, every account belongs to a person, and the separation of privileges does the rest. It's a good model. It held up for decades.
It assumes every actor is a human. That assumption is now quietly false.
"Independently verifiable" is an easy claim to make and a hard one to deliver, so this post walks through exactly how it works in the Tamper-Evident Audit Log for Jira — every primitive, every design choice, and the one file that makes the whole thing portable. None of it is exotic; the point is the combination.
After a production incident, someone always asks the timeline question: who changed what, and when? Ask experienced engineers how they answer it and you'll hear the same thing, almost word for word: logs. Application logs, change logs, auth logs, git history. And they're right — logs are exactly the right tool for that question.
Until the person asking it stands outside your trust boundary.