AI / OpenClaw Interview Questions
Why does an audit log stored in a mutable logs directory undermine forensic attribution?
An audit log is only useful for investigating an incident if it can be trusted to accurately reflect what actually happened.
- If the log lives in a directory the agent itself can write to, a compromised agent, or a malicious skill running with the agent's permissions, could overwrite or delete relevant entries
- This removes the evidence an investigator would need to reconstruct what actions were taken and when
- Security researchers have flagged this as a specific governance gap in OpenClaw's default logging setup, since it undermines compliance auditability, not just convenience
The general principle here applies well beyond OpenClaw, an audit trail that the system under investigation can itself modify isn't really an audit trail, it needs to be stored somewhere the potentially compromised component can't reach.
What can a compromised agent do to a mutable audit log directory?
What does this issue undermine beyond simple convenience?
More Related questions...
