> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/workflow-guides/assurance/retention.md).
# Retention
**Open this area:** In the CORTEX menu, select **Assurance & governance → Preservation & archive**.
Apply a versioned owner-approved review rule to an exact record and retain an independent appraisal with its next review date.
**Who uses this:** Analyst, Reviewer, Administrator.\
**Open in CORTEX:** `/governance/retention`.\
**In-app guide:** `/help?topic=retention`.
**Expected result:** An attributable, time-bound review decision retains its exact rule, profile, event evidence and record revision.
## Before you start
* Obtain an approved UK profile and the actual organisational records/legal-owner decisions, including conflicts between powers, jurisdictions and preservation duties.
* Select the correct workspace. Retention read, proposal and independent-review permissions are separate from ordinary access to the record and its lineage.
* Do not invent a blanket period. Identify the record category, purpose, event and evidence used to start the review interval.
## What to do
{% stepper %}
{% step %}
## Propose the review rule
Open Governance, Retention review schedules, then Propose review schedule.
The page first shows workspace/write authority and approved-profile prerequisites. Complete four validated steps:
* Scope and accountable owner
* Named triggering event and actual interval with effective dates
* Authority/conflicts and approved UK profile
* Proposal reason and review
Each step marks missing inputs and blocks Continue until they are complete. The final action saves a full Draft proposal; the domain does not allow an empty rule draft.
{% endstep %}
{% step %}
## Obtain independent owner approval
The named records owner needs retention approval permission and must not have authored any proposal revision.
Record the actual owner and legal-review references plus the decision reason. Approval makes an effective rule available for new appraisals; it does not grant a statutory power or enable deletion.
{% endstep %}
{% step %}
## Open an exact-record appraisal
From the record's Preservation page choose Open retention appraisal, or use Apply rule to a record on the approved schedule.
The page shows the required retention write authority, accessible exact record and approved applicable rule as prerequisites. Inspect the record and select a rule before entering:
* Required UTC event time
* Event evidence
* Category reason
The page shows missing inputs immediately; evidence and reason each need 10 to 2,000 characters. The displayed first review date is calculated from that event. A date in the past means review is due.
The final action opens an attributable appraisal, not a disposable draft.
{% endstep %}
{% step %}
## Appraise independently
A retention reviewer separate from the appraisal registrant inspects the pinned rule, record and current holds.
Choose:
* Retain
* Extend review date
* Archive decision
* Transfer decision
* Propose disposal
Record evidence, rationale and a future follow-up date. An extension must move the previous review date forward.
{% endstep %}
{% step %}
## Carry out follow-on work separately
Appraisal decisions are not completed operations; proposed disposal never erases content.
For a Transfer outcome, use Prepare custody transfer and the custody-transfer guide to prepare exact snapshots, obtain an independent offer and record recipient acceptance.
Use Inspect current record, archive and holds for the existing reversible archive workflow. Preservation holds remain separately controlled.
No appraisal removes original bytes, derivatives, indices, packages, history or backups.
{% endstep %}
{% step %}
## Preserve an explicit dependency inventory
Open Governance, Preservation inventories.
The page shows workspace/retention/hold authority, exact accessible root/dependencies and owner/approved-profile prerequisites. Complete three validated steps:
* Inspect the root and each known dependency or retained-lineage record with its exact revision and relationship.
* Record accountable owner, authority, profile, disclosure duties and coverage/exclusions.
* Review the exact inventory and rationale.
Missing inputs block Continue and final registration. Registration places no holds.
On the saved inventory, Apply or resume listed holds and check every coverage row.
{% endstep %}
{% step %}
## Recover partial preservation safely
Application proceeds record by record. Earlier successful holds survive a later failure; refresh and retry the same inventory to recover an uncertain response without duplicate holds.
A changed pending revision or explicitly released inventory hold requires a fresh reviewed inventory.
Release each hold through its record's existing authority-bearing release action, then refresh coverage. Snapshots, audits and the immutable inventory remain retained.
{% endstep %}
{% step %}
## Prepare an exact disposal plan
On a current ProposeDisposal appraisal choose Prepare disposal plan, or open Governance, Disposal plans.
The page shows explicit disposal-preparation authority, current same-owner appraisals and actual permanent-disposal/retained-evidence policy as prerequisites. Complete three validated steps:
* Exact appraisals
* Authority and duties
* Execution deadline and reason
The preparer must differ from the named records owner; the deadline must be future and within every follow-up date. Missing inputs block Continue and final preparation.
Preparation removes nothing. Active holds, pending preservation, inaccessible copies and unaccounted-for dependencies block the plan.
{% endstep %}
{% step %}
## Review removal and retained evidence separately
Inspect the saved plan's exact records, source profiles, storage hashes and declared duties.
Expand Remove and Retain under separate control-evidence policy groups.
The named records owner must be independent of the preparer and hold explicit disposal approval permission. Record actual evidence and reason before approving exact permanent disposition.
Approval is not a completion receipt. Revocation preserves the history and cannot recall already removed copies.
{% endstep %}
{% step %}
## Arrange controlled execution
Give the approved plan identifier to the authorised node operator and arrange a maintenance window.
Web is stopped while the operator rechecks current owner authority, holds and dependencies and runs the exact approved operation. Obtain its retained completion reference after every removal is verified.
The page's Approved state remains approval history. Failed or interrupted work keeps the node stopped for recovery; do not remove custody or recovery markers.
{% endstep %}
{% step %}
## Review changes and recover conflicts
Amending a rule creates a new draft and clears its approval. Withdrawal prevents further use. Earlier appraisals retain their exact rule and source profile.
If the target revision, rule or profile changes, open a fresh appraisal against the current approved scope.
A concurrent decision preserves your entered notes: refresh and compare before retrying.
{% endstep %}
{% endstepper %}
## Check the result
* Does this purpose/category rule apply to this exact record?
* Is the named event supported by actual evidence?
* Are owner and legal decisions real, current and independent of proposal authors?
* Have holds and preservation obligations been considered?
* Is the next review or follow-up date explicit?
## If you get stuck
Does a deletion intent prove completion?
No. Execution records an intent before removal and a separate receipt after verified absence. Current owner access, approval, deadline, holds and dependencies still apply during an interrupted operation.
Missing or incomplete custody must be recovered by the operator, never replaced with an empty ledger or an older backup. A stale node checkpoint or restore marker requires reconciliation with current independent custody; do not remove the marker to force startup.
A restored older copy of a completed disposal is removed again before the site becomes available.
How are months and years calculated?
Calendar arithmetic preserves the UTC time and uses the last valid day where needed: 31 January plus one month is 28 February, or 29 in a leap year.
Intervals are explicitly supplied; bounds of 73,050 days, 2,400 months or 200 years protect input arithmetic and are not recommended retention periods.
Does approving an appraisal delete or archive a record?
No. The appraisal is an attributable decision and follow-up date. Existing archive designation is a separate reversible preservation action. No automatic expiry job or deletion capability is introduced.
Can an old approved rule silently change an appraisal?
No. The exact rule version/hash, approved profile and owner/legal references are retained with the appraisal. New decisions require the same rule to remain approved, effective and current; otherwise register a new appraisal.
Why can I not approve my own proposal?
Rule approval belongs to the named records owner, who must be separate from every proposal author. Appraisal decisions require a reviewer separate from the person who registered that appraisal. Permission alone does not remove this separation.
Why is a managed node unavailable during maintenance?
The node permits one Web host or operator command at a time. An interrupted destructive maintenance operation keeps startup blocked until the operator resumes its exact approved plan and verifies completion.
Contact the node operator; do not remove the recovery marker or repeat an appraisal to bypass it. Retained records and approvals are not silently discarded.
## Responsibility and limits
* New capabilities require explicit grants; upgrade does not appoint reviewers or grant retention authority.
* The appraisal retains target identity/version/hash and combined record/rule handling. Current ordinary target access is still required to view it. An inaccessible item fails the result page safely; narrow the search to accessible records.
* Registration can be retried with unchanged values on the same page after an uncertain response. A different operation identifier creates a separate attributable appraisal.
* Disposal read, preparation and approval are new explicit grants, separate from review-only retention permissions. Workspace Manager narrows these grants and never creates them. Saved plans retain their combined handling and control evidence even when an ordinary target later becomes unavailable.
* Disposition inspection is conservative: up to fifty thousand documents or 128 MiB, sixteen roots and 128 selected storage items, including original chunks. Unmapped dependencies and larger scopes need reviewed domain work; do not bypass a hold or remove records manually. Backup expiry and recipient copies remain actual owner duties.
* Each schedule/appraisal retains up to 32 revisions and one MiB. Reaching a bound never discards history. Access loss clears sensitive page content.
* Preservation inventories require retention read and governance read plus ordinary access to every listed target; one inaccessible dependency withholds the whole result. Applying holds also requires retention write and preservation hold permission. Release uses separate preservation-release permission.
* An inventory supports sixteen explicit records and one MiB of metadata. Existing snapshot/hold/audit bounds apply to each target. Coverage is a fresh per-record observation, not automatic dependency discovery or a guarantee against later changes. Original files, prior history, backup and recipient duties remain in their existing stores.
* Permanent disposition requires actual approved records/legal policy and explicit offline execution. Retry barriers prevent recreation of disposed identifiers and original uploads. Supported restore reconciles against current independent custody before startup; missing custody, new holds or unknown dependencies keep the node stopped. Backup-media expiry and recipient copies remain actual owner duties.
* Transfer receipt never permits sender disposal.
**Reference and scope:** F15 review-first delivery. Actual records/legal-owner decisions and jurisdiction-specific authority remain required; no legal duration or deletion authority is inferred.
## Related workflows
* [Preserve an exact revision and manage holds](broken://pages/0185ca5a2331760fb4c59665b8dde7f4d80e0fc6)
* [Transfer exact record custody](broken://pages/f374241d0088f765be654a3a6e15ab522d3ecf7e)
* [Record processing purposes and privacy applicability](broken://pages/d290389040afc56efcecf55b7fc2e72ff1dc1dee)
* [Handle rights requests and retain response evidence](broken://pages/a35e2f0757e5c31ace450534e7af7b26f6940365)
* [Manage accounts, grants and workspace membership](broken://pages/99c8701bc497eefb32769b668198b1f9f5fc6a93)
* [Find evidence and select exact retained passages](file:///7397340/analyse/memory.md)