The Gold Standard · Anthropology
Make the decision path visible
A revocation can reach every named person on the original delegation list and still leave a live route behind. A former contractor may control a shared inbox, a workflow account may continue to approve records, or a subdelegate may have no current principal even though their operational permissions remain.
The gold standard reconstructs authority from evidence rather than job titles, identifies orphaned delegates, suspends consequential action, restores a responsible owner and reconciles every surviving route with one authoritative closure state.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · FIND THE GAP
1. Define a revocation-chain gap
A chain gap exists when a person, service, mailbox, credential or copied record can still exercise or represent authority but no verified current link joins it to the principal and governing appeal. The gap concerns control, not merely an untidy directory.
Record the appeal identifier, revoked authority, effective time, last verified principal, delegated function and decisions the route can still affect. This keeps the investigation bounded to material authority rather than every historical contact.
CHAPTER 2 OF 12 · FIND THE GAP
2. Recognise an orphaned delegate
An orphaned delegate retains operational power or a credible appearance of power without a current accountable principal, service owner or review path. Examples include a departed subdelegate, an unowned group account and an inherited role that survived organisational change.
Do not call every unreachable person orphaned. A named officer can be temporarily unavailable while their institutional authority, supervisor and service record remain intact. Orphanhood is a broken accountability link combined with residual capability or reliance.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · FIND THE GAP
3. Reconstruct the actual delegation graph
Start with the principal and follow appointment letters, assignment logs, forwarded cases, access-control records, shared-mailbox membership, workflow rules, repository actions and decisions citing the acknowledgement. Mark each edge as verified, expired, disputed or unknown.
A tidy organisation chart is weak evidence when work moved through informal forwarding or automated services. The graph should show who could act, what they could do, when the link applied and which system proves it.
| Field | Evidence question |
|---|---|
| Authority | What could the route do? |
| Principal | Who currently answers for it? |
| Control | Which system enables action? |
| Consequence | What decision can it affect? |
CHAPTER 4 OF 12 · CONTAIN THE EXPOSURE
4. Rank gaps by consequence and reversibility
Prioritise routes that can close appeals, overwrite records, trigger publication or influence a hard-to-reverse decision. Lower priority may be a labelled historical copy with no current decision path.
Use consequence, reach, recency and ability to act as separate fields. A rarely used account with approval power can require faster containment than a frequently viewed archive copy.
CHAPTER 5 OF 12 · CONTAIN THE EXPOSURE
5. Suspend unsafe authority without destroying evidence
Freeze the relevant credential, remove the route from current queues or require dual review while the link is investigated. Preserve logs, messages, role history and affected outputs.
Deleting the account may stop one symptom but erase evidence of delegation and downstream use. Containment should prevent new reliance while allowing reviewers to reconstruct what happened.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · CONTAIN THE EXPOSURE
6. Worked example: a revoked liaison leaves an orphaned shared inbox
A principal revokes a liaison after a proxy-record scope error. The named liaison and two known delegates acknowledge the change, but a shared inbox still auto-assigns cases to a contractor team whose service agreement ended. One rule can also mark an appeal complete when the inbox sends a standard reply.
The owner pauses the completion rule, exports the assignment and reply logs, identifies the last service owner and checks every closure made after revocation. A current records team accepts the valid routing function, the contractor access is removed and the false closure is reopened. Changed-context check: if the mailbox is an enduring institutional service with a registered owner, current mandate and independent authority, staff turnover alone does not make it orphaned.
| Route | Immediate action |
|---|---|
| Closure account | Pause completion |
| Shared mailbox | Restrict membership |
| Historical export | Label and isolate |
| Unknown service | Freeze and investigate |
CHAPTER 7 OF 12 · RESTORE OWNERSHIP
7. Decide whether to relink, retire or investigate
Relink a necessary function only when its present mandate, scope and owner are evidenced. Retire capability that no longer serves a legitimate purpose. Escalate for investigation where the route was used after authority ended or ownership remains contested.
Do not relink first and ask questions later. Reconnection can legitimise an unsafe route and blur the boundary between historical use and newly approved authority.
CHAPTER 8 OF 12 · RESTORE OWNERSHIP
8. Restore accountable ownership
Name a role and a responsible person or service team, define the delegated function, prohibit unauthorised onward delegation, set review and expiry points and connect the authority record to the technical permission.
Ownership is not complete when a manager merely agrees to watch the inbox. The governing record, access system and operational procedure must point to the same current authority.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · RESTORE OWNERSHIP
9. Reconcile every closure claim
Compare case status, acknowledgement receipts, repository labels, exported spreadsheets, mailbox rules and downstream decisions. Designate one authoritative current state and label each conflicting item as historical, superseded, corrected or unresolved.
Preserve the original event and the reason it stopped governing. Authoritative closure is a reconciled claim supported across control points, not the deletion of inconvenient history.
| Element | Required proof |
|---|---|
| Mandate | Current governing record |
| Owner | Named accountable service |
| Permission | Matched technical access |
| Expiry | Review or termination trigger |
CHAPTER 10 OF 12 · PROVE CLOSURE
10. Build a closure bundle that exposes residual limits
Include the revocation record, delegation graph, gap register, containment actions, access evidence, relinking decisions, affected-case review, current closure state and any unverified route with an owner and trigger.
A bundle should let a new reviewer determine what is known without relying on the investigator who assembled it. State sampling, missing logs and inaccessible systems plainly.
CHAPTER 11 OF 12 · PROVE CLOSURE
11. Run a changed-context authority test
Test a staff exit, team rename, supplier change, mailbox migration, offline export and unavailable principal. Ask whether the current owner, scope, expiry and revocation state remain discoverable after each transfer.
The test is not a promise that every future route has been found. It reveals which identifiers and controls fail when the social setting changes.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · PROVE CLOSURE
12. Audit chain health after closure
Track unowned permissions, unknown subdelegations, service accounts without principals, conflicting case states, time to containment, decisions reviewed, expired links still active and repeat gaps from the same process.
The gold standard closes the appeal only when the surviving authority is both operationally controlled and institutionally accountable, with residual uncertainty bounded rather than hidden.
| Measure | Warning |
|---|---|
| Unowned permission | Authority orphaned |
| Unknown onward link | Graph incomplete |
| Two current closures | State conflicted |
| Repeat orphan | Design weakness persists |
Frequently asked questions
Is every departed delegate an orphaned delegate?
No. The issue is residual capability or reliance without a current accountable link, not departure by itself.
Should an orphaned account be deleted immediately?
Contain its authority first and preserve evidence. Deletion can remove logs needed to identify affected cases and downstream decisions.
Can a service role outlive the person who held it?
Yes, when the institution records a continuing mandate, current owner, bounded function and matched technical control.
What makes closure authoritative?
One reconciled current state supported by the authority record, operational systems, affected-case review and an explicit account of residual limits.
Continue through verified routes
Core routes
Anthropology subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Revocation propagation, downstream delegation chains and closure reconciliation
- Acknowledgement revocation, changed authority and reopening false closure
- Correction acknowledgement authenticity, delegated receipts and false closure
- Correction acknowledgement failures, unreachable recipients and residual exposure