S4.17 - Retention_and_access_control

S4.17 ? Retention and access control

flowchart LR
    A[Evidence is needed for review and audit] --> B[RAIDT
run-level evidence framework]
    A2[Traditional limitation:
keep records securely, but without run-specific retention or access rules] --> B
    B --> C[[S4.17 Retention and access control
governs what evidence is kept, who may access it, and for how long]]
    C --> D[Evidence pack
proportionate retained artefacts]
    C --> E[RAIDT score profile
stronger Responsibility, Auditability, Traceability]
    C --> F[Governance outcomes
reviewability, contestability, audit readiness]
    D --> G[Reviewer reconstruction]
    E --> H[Governance readiness]
    F --> I[Organisational learning and policy alignment]
    J[Retention period / review date] --> C
    K[Authorised roles / approvals] --> C
    L[Sensitivity label / minimisation] --> C
    M[Redaction status / storage form] --> C
    N[Deletion trigger / exception log] --> C

← Star S4 - Evidence Architecture and Artefacts

Star context: Specifies the concrete fields and artefacts that make a run record inspectable, governable, and safe to retain over time.

Academic picture

Definition / background

Retention and access control refers to the rules that govern how long RAIDT evidence is kept, which people or roles may inspect it, what protections apply while it is stored, and when it should be restricted, deleted, redacted, or reviewed. Conceptually, it draws from records management, information governance, privacy protection, security control, and audit trail design. In a governance setting, it answers a simple but consequential question: once evidence about a GenAI run has been created, how is that evidence itself governed?

This item matters because RAIDT is explicitly evidence-led. A framework that asks organisations to preserve run-level evidence without specifying retention and access conditions would create a secondary governance failure: the evidence pack would improve accountability while potentially increasing privacy, confidentiality, and operational risk. Retention and access control is therefore not an optional administrative add-on. It is part of the architecture that makes evidence proportionate, defensible, and usable.

It is also distinct from a generic enterprise retention policy. A general policy may define how long classes of documents are kept across the organisation, but RAIDT asks how the evidence of a specific GenAI run should be handled. That means the focus is narrower, more operational, and directly linked to the run record, evidence pack, and score profile. In RAIDT, this item sits inside the evidence architecture because it determines whether evidence can be retained in a way that remains inspectable without becoming an unmanaged liability.

Why this concept matters

Retention and access control solves a core governance tension in GenAI oversight: organisations need enough evidence to reconstruct, review, and contest a run, but they should not retain sensitive material indefinitely or expose it to inappropriate access. Without this item, evidence collection can become indiscriminate, roles may be unclear, deletion may be ad hoc, and audit readiness may come at the cost of data protection and trust.

In practice, this concept avoids two common failures. The first is over-retention, where teams keep everything "just in case" and create unnecessary privacy, confidentiality, or cyber risk. The second is under-governed access, where evidence exists but is visible to staff who do not need it, or cannot be accessed by legitimate reviewers when a run must be investigated. RAIDT makes these issues explicit at the run level so governance moves from broad principles to operational controls.

Key idea: retention and access control matters because RAIDT evidence is only governance-ready when it is both reviewable and proportionately protected.

What this item controls

The retention period or review window for run-level evidence and associated artefacts.
Which roles may access evidence, under what authority, and for what governance purpose.
Whether evidence must be stored in full, minimised, redacted, pseudonymised, or referenced indirectly.
How sensitivity labels, privacy safeguards, and security controls attach to the evidence pack.
When deletion, archival review, escalation, or exception handling should occur.
How evidence availability is balanced against confidentiality, data protection, and operational risk.
Whether RAIDT scoring can treat the evidence record as proportionate and governable rather than merely present.

Practical example / likely audience question

Audience question

If RAIDT encourages organisations to keep richer evidence about GenAI runs, does it not simply create a larger privacy and security problem?

Answer

That concern is valid, and it reflects a common misconception that better evidence always means keeping more raw material for longer. The direct answer is no: RAIDT does not require indiscriminate retention. It requires governed retention. The point of this item is to make the evidence layer itself subject to minimisation, access restriction, and retention discipline.

Consider a run that supports internal HR drafting. The prompt, retrieved documents, and output may contain personal or commercially sensitive information. A generic governance approach might say only that records should be stored securely. RAIDT goes further by asking what evidence is necessary for later review, what can be hashed or summarised instead of stored in full, who can inspect the evidence pack, and when parts of that record should be deleted or restricted. That distinction is important because it turns a vague policy aspiration into an inspectable run-level control.

This is one of the ways RAIDT handles the issue better than generic AI governance. Rather than assuming that evidence collection is inherently good, it treats evidence as something that must itself be governed. That allows organisations to preserve accountability while reducing the risk that governance artefacts become a new source of harm.

Practical example in RAIDT terms

In a healthcare setting, a hospital uses a GenAI assistant to draft discharge-summary language from clinician notes and approved template material. The run-level issue is that evidence is needed to review what the model was asked to do, what content informed the answer, and why the output looked reasonable at the time. However, the same evidence may contain patient-identifiable or clinically sensitive information.

In RAIDT terms, the organisation should not merely log the run and keep everything indefinitely. It should specify what evidence is retained in the run record, whether patient-linked content is redacted or stored by reference, which reviewer roles may access the material, what retention period applies, and what deletion or review trigger closes the record. Evidence might include a retention rule identifier, an access-role list, a sensitivity label, a redaction status, and a disposal or review date alongside the normal run metadata.

The most affected RAIDT pillars here are Responsibility, Auditability, and Traceability, with Dependability also relevant because poor retention practice can undermine reliable review and incident response. By making retention and access control explicit, RAIDT improves governance readiness: a reviewer can see not only the evidence that exists, but also why that evidence was retained in that form and under those access conditions.

Detailed link to RAIDT

Retention and access control links to RAIDT in four ways.

First, it supports RAIDT's core idea that GenAI governance should be grounded in inspectable evidence rather than organisational assertion.
Second, it operates at the level of the individual run, specifying how the evidence produced by one configured use of a system should be retained, restricted, reviewed, or deleted.
Third, it shapes both the evidence pack and the score profile, because evidence that is retained without proportionate safeguards should not be treated as fully governance-ready.
Fourth, it strengthens reviewability, contestability, audit readiness, and organisational learning by ensuring that evidence remains available to the right reviewers without becoming uncontrolled or unsafe.

Retention and access control ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

Link to the five RAIDT pillars

Responsibility

This item supports responsibility by showing that evidence collection is bounded by proportionality, privacy protection, and role accountability rather than by unchecked logging.