Retention: Lifecycle and operations
Governs object deletion against retention profiles, legal hold flags, ownership evidence, and immutable audit records without providing legal advice or deleting data under active hold.
Package status: AI-assisted reference package. Static package validation has passed; implementation scenarios remain not run and human domain review is required before stable adoption.
Decision
Object deletion follows a retention profile chosen by the organization, not ad hoc operator convenience. Each object moves through active, retention-eligible, deletion-requested, soft-deleted, and purged lifecycle states with explicit gates. Legal hold is an orthogonal attribute that may be attached to any non-purged object, preserves its prior lifecycle state, and blocks purge until an authorized release is recorded with reference evidence. Deletion requests require ownership evidence from the uploader or a delegated admin role. A grace period allows restoration before irreversible purge. All hold changes, deletions, and purges append immutable audit events. This block describes operational controls only; it is not legal advice and does not certify regulatory compliance.
Scope
- Retention periods by object class, legal hold application and release, and deletion workflow.
- Ownership evidence checks, grace periods, soft delete, and scheduled purge.
- Immutable audit logging for hold and deletion events.
- Operational metrics and alerts for hold purge attempts.
Outside this block
- MIME verification and malware quarantine.
- Backup restore procedures and off-site copy lifecycle.
- Jurisdiction-specific legal interpretation or records-management counsel.
Contract
- Objects become deletion-eligible only after their profile retention period elapses and no active legal hold applies.
- Legal hold may be applied to any non-purged lifecycle state, requires a reference identifier, preserves that lifecycle state, and blocks purge and hard delete until released by an authorized role defined in the profile.
- Legal hold release removes the hold attribute without inventing a new lifecycle transition; ordinary retention and deletion rules then continue from the preserved lifecycle state.
- Deletion requests from principals without ownership evidence or delegated admin rights are rejected with auditable denial.
- Deletion-requested state honors a grace period during which authorized owners may cancel; after grace, objects move to soft-deleted and lose download serving.
- Purge jobs permanently remove storage bytes only from soft-deleted objects not on hold and must write immutable audit entries with object identity hash and timestamp.
- Automated purge or lifecycle rules that encounter hold-protected objects skip them, emit alerts, and never partially delete associated metadata without audit.
Implementation guidance
- Store retention class and hold state on object metadata replicated to lifecycle workers and admin APIs.
- Use soft-delete prefixes or tombstone flags compatible with related orphan-cleanup blocks.
- Immutable audit may append-only store or WORM bucket; profile chooses mechanism.
Failure handling and safeguards
- Conflicting hold release and deletion commands resolve in favor of hold until explicit release is recorded.
- Purge failures retry idempotently; do not mark purged until storage deletion confirms.
- Backup systems must respect hold flags or document compensating restore procedures outside this block.
Verification and operations
- Track objects on hold, pending purge count, grace cancellations, and hold-blocked deletion attempts.
- Test unauthorized deletion, hold during eligible window, and restore within grace.
- Drill purge audit reconstruction from immutable log samples.
The executable-looking examples in this package are fixtures and acceptance contracts. Run static validation on the package structure and metadata, then implement and execute the scenarios in the target repository.
Adoption assumptions
- Names and numeric values in
example.yamlare an adoption profile, not universal defaults. - Retention periods and roles must be chosen with organizational legal and records counsel.
- ISO records-management and FTC retention guidance inform structure but do not replace jurisdiction-specific policy.