AI Audit Evidence, Part 6: A Record Nobody Read Is Only Stored

A record sat in the database for a year before anyone opened it.

That is not negligence. There is no place in the system that says who should read it, or how often.

One sentence: a record was written is not the same as a record was read. A record nobody read is only stored.

If that is enough, the list and the three criteria can be skipped.

1. Three acts that look like review, and are not
   Write confirmation happens before execution. It proves someone approved this action. It does not prove anyone looked at the record afterwards.
   Alert acknowledgement happens after an anomaly. It proves someone handled the alert. It does not prove the routine records were read.
   Dispute acknowledgement happens when a revocation does not match. It proves someone decided that dispute. It does not prove the rest were read.
   All three are a person doing something to an event. None answers "who read this record, and how often".

2. Three criteria
   A named reviewer and a cadence, in configuration. Not an oral agreement, and not "everyone looks".
   The receipt is a row on the chain. Each review is itself a chain row, verifiable offline, so "reviewed" cannot be backfilled without breaking the signature.
   Unreviewed intervals are computed from the chain and reported as unknown in the coverage statement. They are never green.
   Miss one and the capability does not hold: criterion 1 alone is a rota, criterion 2 alone is a receipt, all three are a verifiable review.

The receipt has to say four things: who read it, when, which interval it covers, and what the conclusion was. The conclusion has three values only, and "roughly looked at" is not one of them.

One more premise: the reviewer cannot be the person who executed the action. Reading your own record is not review, it is a look back. High-risk records get a tighter cadence; routine records can be looser. The cadence lives in configuration, not in a document.

The reading has three values, no fourth:

receipt present and chain verifies -> reviewed
no receipt -> unknown
receipt present but chain fails -> invalid (never reviewed)

1. What can fail Delete a review receipt: the interval returns from reviewed to unknown. Forge a receipt: the chain fails. These two are what make the capability testable. Without them, "reviewed" is a field, and it makes the same mistake as "revoked" being a status bit.

The easiest mistake is not skipping the review, but storing the receipt in the wrong place: a mutable table where anyone can add a row, while the chain gains nothing. Then "reviewed" appears, and nothing can prove it happened at the time.

1. Where we are AiAuditLog has no reviewedAt or reviewedBy, and the codebase has no notion of a reviewer or a cadence. The three human-action mechanisms above do not cover record review. So this item is zero from fields to criteria. This is a design, not an implementation.
2. The reader made the question sharper A plate-search log existed for a year before it was first reviewed.

We first read the problem as "nobody has a reason to read it". The reader corrected that: what is missing is ownership, not motivation. It was not that nobody wanted to look; nobody was assigned to look.

The same reader then upgraded the criteria to three: a named reviewer and cadence, the receipt on the same chain, and unreviewed intervals reported as unknown.

The three criteria in this article are the version after that correction.

1. Three limits All three criteria are zero. This is a design, not an implementation. A receipt on the chain changes the shape of the chain and needs a contract change. The cost is not estimated. "How often" has no universal answer; it has to be set per record type. One question this article does not answer: what happens after a review finds a problem? It decides whether the receipt needs a follow-up field, and it is its own piece. Closing The value of audit evidence is not that it is stored. It is that someone read it, and that the reading itself can be verified.

A log nobody read only proves that we recorded diligently.

The implementation described here comes from the open-source project KeelBase:

https://github.com/rain6fish/KeelBase
Drafted with an AI assistant. The system, the positions and the mistakes are mine.