Courts IT must ensure AI audit logs for the clerk assistant cannot be quietly altered after an incident. Which control best protects those logs?

Courts AI audit logs for a clerk assistant must remain trustworthy after an incident, so storing them write-once with protections against tampering is the control that best preserves investigative integrity. Investigators and oversight bodies need assurance that prompt/response audit trails, access events, and administrative actions were not quietly edited by an insider or an attacker covering tracks. WORM object locks, append-only logging services, cryptographic chaining, or equivalent municipal controls make unauthorized alteration detectable or impossible within the retention window. For courts IT, AI logs can become evidence about who queried sealed matters or how a bad answer was produced; integrity of that trail is as important as confidentiality.

Storing AI audit logs encrypted with access controls against alteration fails integrity because encryption protects confidentiality, not immutability, and access controls can be changed by privileged admins who can grant themselves edit rights and quietly modify entries without write-once enforcement. Storing AI audit logs replicated with versioning for high availability fails because replication only creates extra editable copies for uptime and versioning only records new versions, so a privileged attacker can alter all copies or add an altered version and the trail remains mutable without write-once protection. Storing AI audit logs compressed with retention policies for archiving fails because compression only reduces size and retention policies only schedule how long to keep archives, but neither makes entries immutable, so a privileged user with write access can still silently modify or replace logs.

Exam caveat: Tamper resistance requires storage that is not writable by the population being audited, and a preservation mechanism whose failure path preserves and alerts rather than deletes; storing logs replicated with versioning for high availability does not provide that tamper resistance because versioning without write-once storage still leaves all copies editable and altered versions can be added without detection. Storing logs compressed with retention policies for archiving is not write-once protection because compression and retention scheduling do not block writes, so the same privileged users who manage archives can modify the data within the retention window. Also distinguish application debug logs from formal audit logs; only the latter typically require write-once retention suitable for investigations and court administrative review.

Operational check: Place clerk-assistant audit events in WORM/append-only storage with defined retention; restrict delete/alter rights so encrypted copies with access controls alone cannot be overwritten or altered by privileged key holders before the retention period expires; alert on retention-policy or immutability changes; periodically verify replicated copies with versioning for consistency and alert on divergence, but replication with versioning alone does not prevent a privileged admin from silently altering all copies or adding an altered version; and ensure compressed archiving with retention policies preserves immutability, never just saves space, because compression without write-once storage still permits privileged users to replace archived logs.