A system must retain audit history for a stated period and restrict alteration. What should acceptance criteria include?

1. A statement that every user promises to be careful
2. Only the number of dashboard colors
3. Observable retention and access-control behavior for the audit records
4. Only whether the screen opens quickly