Why does an audit log stored in a mutable logs directory undermine forensic attribution?

An audit log is only useful for investigating an incident if it can be trusted to accurately reflect what actually happened.

• If the log lives in a directory the agent itself can write to, a compromised agent, or a malicious skill running with the agent's permissions, could overwrite or delete relevant entries
• This removes the evidence an investigator would need to reconstruct what actions were taken and when
• Security researchers have flagged this as a specific governance gap in OpenClaw's default logging setup, since it undermines compliance auditability, not just convenience

The general principle here applies well beyond OpenClaw, an audit trail that the system under investigation can itself modify isn't really an audit trail, it needs to be stored somewhere the potentially compromised component can't reach.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.