Every query and every decision, logged

The verifiable record: each read-only query (with the query it ran), each proposed change, and each approval or rejection.