Check eligibility
Evaluate retention, all holds, WORM/Object Lock and handover obligations for the frozen object set.
MOBILE-ID · TRUSTED LTANS
Controlled Disposition
Evaluate eligibility, authorize and reconcile stores/copies before concluding disposition.
Outcome and scope
Execute an approved lifecycle decision and identify which copies were or were not processed.
Documentation scope Workflow design and integration contract; operational configuration is confirmed per environment.
| Prepare | Receive |
|---|---|
| Expired records with no active hold and satisfied storage-lock and policy conditions. | A result record scoped to content/evidence, including unresolved portions. |
Participants: Data owners, approvers and storage operators.
Workflow and decision points
Approve effects
Separate content, evidence, metadata and replica scope. Command-submission rights do not imply approval rights.
Execute per store
Recheck immediately before effects and retain per-target checkpoints and outcomes; one store response is not overall completion.
Reconcile residuals
Partial results retain residual copies, causes and resumption authority. Backup behavior requires separate definition.
States, guards and authority
| Current | Guard | Actor | Next | Artifact / recovery |
|---|---|---|---|---|
| Requested [model] | Retention satisfied, no hold, scope frozen | Data owner + approver | Approved [model] | Retain per-copy-class decisions; separate submission and approval. |
| Approved [model] | Recheck holds, storage locks and checkpoints | Storage Service | Executing / blocked [model] | New holds block remaining effects; old approval cannot override new guards. |
| Executing [model] | Reconcile every in-scope destination | Storage + Operations | Complete / partial [model] | Retain residuals and agreed backup handling; no absolute-erasure claim. |
Exceptions and controls
| Situation | Action | Boundary |
|---|---|---|
| Hold appears after approval | Block before effects and request review. | Earlier approval does not override new constraints. |
| A copy cannot be processed | Keep PARTIAL and checkpoints. | No complete or absolute-erasure claim. |
| Customer-owned store | Reconcile using the custodian’s authority and receipts. | State the responsibility boundary. |
Authorization, approval and recovery
Recheck eligibility immediately before effect; require disposition:approve and dual control. Payload export does not authorize evidence deletion.
Hold or Object Lock blocks execution. Partial deletion remains PARTIAL; reconcile copies and resume from checkpoints without false completion.
Reconciliation artifacts and acceptance
Record requester/approver, final hold check, scope, per-copy results and PARTIAL status when work remains.
- A hold activated between approval and execution blocks subsequent effects.
- A store failure yields a partial result and resumption covers only outstanding work.
Integration and data contract
| API | Application scope | Documentation |
|---|---|---|
POST /v1/archives/{archiveId}/dispositions | disposition:write | Archive API |
Technical input and references
| Element | Definition |
|---|---|
| Input | Expired objects, all holds, WORM locks, approval decision and inventory of affected copies. |
| Output | Disposition record with payload/evidence scope, times, per-store outcome and outstanding copies. |
Execute and reconcile a scenario
| Element | Action |
|---|---|
| Synthetic ID | disp-test-001 |
| Task | Freeze scope → assess retention/holds → approve → recheck each target before effects. |
| Acceptance case | New post-approval hold blocks effects; report per-replica results and retained backup scope. |
These are business test criteria; synthetic packages alone do not establish backend execution or valid ERS.