Audit log writer

Design an audit-log writer for an internal admin tool. Whenever an admin changes something important (edits a user, deletes a record, changes a permission), you need to record who did what, to which entity, and when, in a way that can be reviewed later and not quietly altered. Write volume is low to moderate; reads are occasional, usually filtered by actor or by entity. Describe the data model and how you guarantee entries aren't lost or tampered with.