WORM compliance object store

Design a WORM (write-once-read-many) compliance object store for regulated records (financial/legal): once written, an object must be immutable and undeletable until its retention period expires, provably, even against a privileged administrator or the storage vendor, with optional indefinite legal holds. Records range from KB documents to GB archives, durability must be eleven-nines, and auditors require tamper-evident proof. How do you enforce immutability and retention you can't bypass?