True, but you don't need access to production data to build an audit logger. And any commits to it should involve code review.