Spec an audit log admins cannot quietly rewrite

Your company needs an audit log for its internal admin tools: who changed what, when and from where. Auditors will rely on it, and the people it records include database admins. A Rust service will take events from every tool and store them, and an agent will build it.

Write the spec you would hand the agent.

What you know:

• Rust and Postgres, and the security team runs a separate AWS account that app teams cannot touch
• about 2 million events a day
• the admin tools call the service over HTTP inside your network, each with its own service token
• years later, an auditor must be able to check that nothing was removed or changed

Then, in a few sentences: what does "log all the admin actions to a table" miss?