Records governance
Records Schedule and Legal Hold
Agent evidence is a record like any other. It has a class, a retention period, a legal basis, and a deletion rule. When a matter opens, a hold freezes the records in scope so nothing ages out while it is live, and discovery can be exported for the matter rather than for the whole estate.
Health
What is kept, for how long, and why
Retention classes by review state, the record volumes under each and the legal holds in force.
Retention schedule
Each class names its legal basis and its deletion rule, and carries a live record count
| Class | Covers | Retain | Basis | Deletion rule | Jurisdictions | Live records |
|---|---|---|---|---|---|---|
| FIN-7Y Review overdue | Financial assertion evidence clearance · approval · posting · reconciliation | 7y | Statutory accounting retention in the majority of operating jurisdictions, aligned to the longest applicable period rather than the shortest. | Deleted at seven years from the close of the reporting period, provided no legal hold is in force on the record or its unit. | US UK DE SG AU | 601 |
| PROC-7Y Review overdue | Supplier and contract evidence clearance · approval · sanctions-check · award | 7y | Contract limitation periods and public-sector supplier audit rights. | Deleted at seven years from contract expiry, not from record creation. | US UK DE SG AU BR | 575 |
| HR-6Y Review overdue | Employment and people decisions assessment · approval · people-decision · appeal | 6y | Employment claim limitation periods, taken at the longest applicable across works-council jurisdictions. | Deleted at six years from the end of the employment relationship. Personal identifiers pseudonymized at two years where the record is retained only for statistical monitoring. | US UK DE FR SG | 604 |
| LEG-10Y | Legal and regulatory correspondence opinion · filing · approval · disclosure | 10y | Regulatory inspection windows and the outer limitation period for corporate filings. | Deleted at ten years. Never deleted while any related matter carries an open hold. | US UK DE FR SG AU BR | 562 |
| CUST-5Y Review overdue | Customer commitment and service evidence commitment · clearance · credit · complaint | 5y | Consumer claim windows and revenue recognition audit trail. | Deleted at five years from the last account activity. | US UK DE SG AU | 2,130 |
| OPS-3Y Review overdue | Operational routing and execution routing · execution · notification | 3y | Internal operating requirement. No statutory driver, so the shortest defensible period is used deliberately. | Deleted at three years. This is the only class where the estate deletes rather than retains by default. | US UK DE FR SG AU BR | 1,093 |
| TECH-3Y | Technology change and access evidence change · access-grant · access-removal · test-result | 3y | Security review and change audit requirement. | Deleted at three years from the change closing. | US UK DE SG AU | 1,784 |
| AI-10Y Review overdue | Autonomous decision evidence agent-decision · override · refusal · promotion | 10y | Model risk and AI regulation expectations on traceability of automated decisions, taken at the longest emerging requirement rather than the current minimum. | Deleted at ten years. Never deleted where the decision affected a person and an appeal window may still open. | US UK DE FR SG AU BR | 707 |
Legal holds
A hold overrides the schedule. Nothing in scope is deleted while the matter is open.
A regulator has asked how payments above the cross-border band were authorized in the two quarters before the materiality policy moved to v9. Deletion is suspended across the whole function rather than a narrower scope, because the inquiry has not yet named the lines it will examine.
A claim has been filed alleging an automated screening step influenced a promotion outcome. Every people-decision record is held, including the records that show the decision was taken by a human, because those are the records that answer the claim.
An unsuccessful supplier has challenged an award on process grounds. The sanctions and beneficial ownership evidence is the material part of the record.
A pattern of approvals just under a materiality threshold was flagged by the observe layer and is being examined. The hold covers the approving authority records as well as the transactions.
A pattern of service credit refusals was raised with a consumer regulator. Held until the regulator confirms it will not open a formal matter.
A defect report against the reasoning model raised the question of whether any judgment-grade decision taken under it needed reversal. Every record written under that model version was frozen while the committee worked through them. The committee closed the review without reversing a decision and the hold was released. The records remain, under their normal retention class.
What a discovery export contains
Machine-readable, matter-scoped
The export returns every evidence record inside the hold scope with its full version stamp, the authority grant cited, the hash link to the record before it, and the chain verdict for each unit touched. It is a JSON file, so counsel can load it rather than read screenshots.
Scope is resolved from the hold itself. A function-scoped hold pulls that function; a period-scoped hold pulls the records written while a named model version was in force. That second case is the one that matters when a model is later found to have been wrong.
A per-unit auditor pack is available from the evidence spine as a document, in PDF and JSON.
Honest limits
What this schedule does not do yet
Nothing here actually deletes. The deletion rules are written and the counts are live, but no scheduled job enforces disposal, and no disposal certificate is produced. That is deliberate for a demonstration estate and should not be read as a working retention engine.
Holds are recorded and scoped, but placing one does not physically write-protect the underlying rows. A real deployment would enforce the freeze in the storage layer, not in the application.
Jurisdiction on a record is a single tag. Cross-border data residency and transfer rules are a much harder problem than one field can carry, and are not modeled.
Actions
What is waiting on a person
Retention only bites at the moment something is due to be destroyed. These are the decisions standing between the schedule and the delete.
Review a record that has reached its retention date
Past the retain period on its class and not yet dispositioned.
Work a class that has records past its date
Of 8 retention classes, these carry the whole overdue population and each needs a disposition decision of its own.
Confirm the scope of an active hold
Each hold suspends destruction for everything inside its scope.
Re-certify a legal hold
Past its own review date. A hold nobody revisits becomes a permanent archive by accident.
Operations
What this desk is allowed to start
A surface that only reports is not operable. This is the work this page can set in motion, and the bound it runs into.
Trigger and bound
This desk can place a hold, release a hold and mark a class reviewed. It cannot destroy anything: the platform has no delete path for spine records, so a retention decision here is a written disposition, and the physical removal happens in the system of record. That gap is deliberate and it is also a limitation — the schedule is asserted here and enforced somewhere else.
Live observability
What the record shows right now
8,051 records sit under a retention class and 2,834 spine records carry a legal hold reference.
Current distribution
8,051 records
Is policy and strategy coming to fruition
Whether the written intent is holding here
2,833 of 8,051 records are past their retain period with no disposition on the record.
Not holding on the record
The written rule is that data is kept for as long as the class says and no longer. In practice 35.2% of everything under a schedule has reached its date and is still held, because disposition needs a person and nothing here forces one. 6 legal holds are on the record, 5 of them active, and a hold correctly overrides the schedule — but a hold that is never re-certified quietly turns into indefinite retention, which is why re-certification is tracked as a queue above rather than assumed. Today every active hold is still inside its own review date.
Why an examiner asks for this first
Retention is where paper trails usually fail