* Use a version control system - keep journal files in eg a github repo; control access, manage pull requests, audit changes in the usual way.

* Use multiple files - the journal can be composed from multiple files, each with different filesystem permissions/accessibility.

* Maintain files on a server, and run a web UI like hledger-web or fava, perhaps behind a login form, to give read-only or add-only access to remote users.