But if an evil admin wanted to and had access to the rails console, they could find and destroy those records. Something like
StaffActions.where("i was being evil").destroy_all
But the evil admin would need to look at the source to see more precisely how to do that.