You are correct. It needs to be anonymous, untamperable, auditable. I recently had a discussion with a friend who asked me how to implement a write only audit

You are correct. It needs to be anonymous, untamperable, auditable. I recently had a discussion with a friend who asked me how to implement a write only audit log that will comply with some finra regulation. I asked him how tamper proof it needs to be, and mentioned his system admin could practically stop the log writer, do shady stuff, and start the log writer and there is nothing you can do about it. As long as someone has access to the system, things can go wrong. I am hoping zero knowledge proof systems will provide some guarantees here some day.