There is a delete button. It refuses, and it says why. Reading the refusal is the exercise.
Records may be added. Never modified, never deleted.
The same discipline a general ledger has used for six hundred years. A correction is a new record that
references the original; both are permanent. The operational consequence — and Module 4 is blunt about it —
is that a data entry error becomes visible, corrected, and permanent, rather than erased.
Why the refusals matter more than the appends
Every custody system can add a record. The question a procurement evaluation should ask is what happens when
someone tries to remove one — and whether the attempt is itself recorded. That is question 3 of the
Module 7 bank, and it is the one most often answered with a policy rather than an
architecture. A policy that an administrator can override is the same problem with a signature on it.