> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/workflow-guides/products/reviewed-derivatives.md).

# Reviewed Derivatives

**Open this area:** In the CORTEX menu, select **Release & sharing → Reviewed derivatives**.

Prepare explicit recipient content, confirm every originator condition, assess implicit disclosure, and obtain separate marking approval.

**Who uses this:** Author, Reviewer, Administrator\
**Open in CORTEX:** `/products/derivatives`\
**In-app guide:** `/help?topic=reviewed-derivatives`

**Expected result:** An exact derivative retains its private sources and independent decisions without changing originals or existing packages.

## Before you start

* Select the workspace and obtain explicit derivative capabilities plus normal access to every source. Read access never grants authority to review or mark material.
* Obtain an effective approved UK agreement with exact parties, purpose and recipient marking, and its current UK profile.
* Identify the actual originator consents, legal and special-policy decisions, and independent marking authority. Real organisational decisions cannot be replaced by example text.

## What to do

{% stepper %}
{% step %}

## Prepare explicit content

Open **Product**, **Reviewed derivatives**, **Prepare derivative**.

The prerequisite panel shows:

* Write access
* One to four current products or approved report projections
* An effective approved UK agreement
* An independent marking authority

**Exact sources**, **UK agreement**, **Recipient content**, and **Review and save** show required fields, issues, and colored step states before **Continue**.

**Recipient content** needs:

* A 3–200 character title
* A 10–24,000 character narrative
* An eligible marking authority

Citations and metadata are optional, with at most 20 lines of 3–1,000 characters each.

A 10–2,000 character reason is required on **Review**.

Only final **Save** retains a draft; no private content is copied automatically.
{% endstep %}

{% step %}

## Confirm every originator

An independent reviewer records the actual authority, exact-audience consent, consultation, lawful powers or absence of authorised operational action, and onward conditions for every source condition.

S2 consultation is mandatory. P does not mean public, and A1–A3 do not grant powers.
{% endstep %}

{% step %}

## Review disclosure and special policy

Review narrative, citations, metadata, and combined-context inference separately.

Record mitigations and residual-risk acceptance.

Explicitly decide whether detainee or other special policy applies, retaining the assessment, actual decision when applicable, and legal-review reference.

Enter an explicit UTC expiry no later than the agreement expiry.
{% endstep %}

{% step %}

## Approve marking separately

The named marking authority, independent of source and derivative authors and the risk reviewer, records:

* The actual authority
* The exact-content marking decision
* Safe recipient handling instructions

This changes only the derivative approval, never original records or older artifacts.
{% endstep %}

{% step %}

## Manage changes and withdrawal

Any content, agreement, audience, purpose, or authority amendment resets all decisions to draft.

A stale source, agreement, profile, expiry, or permission stops a new decision.

Refresh and compare while preserving entered notes.

Withdrawal is terminal and preserves history; create a replacement when needed.
{% endstep %}
{% endstepper %}

## Check the result

* Has every source condition been considered?
* Can combined narrative, citations, or metadata identify a protected source?
* Are actual legal and special-policy decisions recorded?
* Does the separate authority approve this exact recipient marking and content?

## If you get stuck

<details>

<summary>Why did a decision fail?</summary>

Check independent reviewer roles, complete S2 and legal evidence, the exact agreement scope, source currency, UTC validity, and current access.

A changed source needs a replacement derivative. Changed recipient content requires an amendment and all new decisions.

</details>

<details>

<summary>What happens to notes after a conflict?</summary>

Notes remain while you refresh and compare the current record.

Review changed content before submitting again.

Loss of source or workspace access clears the private record and notes.

</details>

<details>

<summary>Does withdrawal recall old downloads?</summary>

No. Records and previously downloaded bytes remain.

Actual recipient transfer, correction or withdrawal notices and acknowledgements require their separate release workflow.

</details>

## Responsibility and limits

* Private derivative records retain the combined source and agreement handling. Internal reviewers still require all source access.
* There is no automatic declassification, overseas sharing, email dispatch, or permission grant.
* Marking approval is not package release. A separate exact-package and protected-source audience/method decision is still required before transfer.
* Up to 32 revisions and four MiB are retained. Bounds never discard previous decisions or rewrite original hashes.

## Reference and scope

F16 domestic sharing: S2 needs consultation; P is not public release; A1–A3 provide no legal powers. Literal deletion alone cannot establish safety.

## Related workflows

* [Prepare an approved UK recipient package](broken://pages/6b0f4486869945a5ea190d9b499799cbe47ee3c7)
* [Prepare a UK sharing agreement](broken://pages/d01ab7701685aeb8c20c3f2edef3d644081ce5d4)
* [Create an immutable literal-sanitised Product](broken://pages/cdb9c7b59bf661ff4d337957385a22c20e4bc07a)
* [Review, approve and publish an exact internal release](broken://pages/470978e3be0758fbc43448d1d7b8fc918bd9675f)
* [Protect source identity and review each use](file:///7397340/collection/source-protection.md)
* [Receive, evaluate and safely use intelligence reports](file:///7397340/collection/intelligence-reports.md)
* [Record processing purposes and privacy applicability](file:///7397340/assurance/processing-activities.md)
* [Manage accounts, grants and workspace membership](file:///7397340/assurance/access.md)