How Two Short-Lived Tables and a Warehouse Can Power Audit Logs

Engineers investigating unexpected system changes typically need to know what changed, who made the change, and what the previous state was. A proposed architecture addresses this by splitting audit data across two short-lived online tables — one compact timeline table for fast recent lookups and one payload table for full event details — alongside a long-term data warehouse for historical queries. The timeline table enables quick per-entity browsing, while the self-contained payload table allows archiving without cross-table joins. Recent audit events are served with low latency for urgent needs like rollbacks, whereas older compliance queries can tolerate higher latency and are handled via SQL in the warehouse. The design trades simplicity for performance, requiring careful handling of write ordering and retry logic to avoid dangling pointers or unlisted events.