THE GOLD STANDARD OF HYDROLOGY · SPECIALIST STUDY
Freeze disposition without freezing scientific understanding, access accountability or the evidence needed to lift the hold safely
A legal, audit or investigative hold suspends ordinary disposition for a defined set of records. In a hydrological forecast archive, that set can include model runs, forcing, observations, issue logs, code, messages, access records and derivatives across primary storage, cold tiers and external custody. A defensible hold separates preservation from public release, identifies exact scope, prevents deletion and silent alteration, creates controlled review copies, reconciles conflicts with normal retention and records the authority and evidence required to narrow, lift or continue the freeze.
This guide belongs to the Hydrology subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Define authority and scope · chapters 1, 2, 3
Preserve across systems · chapters 4, 5
Control review and release · chapters 6, 7, 8
Resolve retention and disposition · chapters 9, 10, 11
Verify, lift and transfer · chapters 12, 13
The whole problem at a glance
| Hold question | Required evidence | Unsafe shortcut |
|---|---|---|
| Who authorised it? | Issued notice and authority | Informal request |
| What is covered? | Custodian, object and date criteria | Whole archive forever |
| What action stops? | Disposition and alteration controls | Assuming read-only access is enough |
| How does it end? | Lift notice and reconciliation | Deleting when a date passes |
Scope and release status must be explicit.
CHAPTER 1 OF 13 · Define authority and scope
1. Distinguish hold, freeze, retention and access
A hold temporarily suspends disposition for legal, audit or investigative needs. Retention sets the normal lifecycle; a freeze implements suspension in a repository; access and public release are separate permissions.
Evidence record: Record definitions, governing policy, issuing authority, recipient, effective time, normal schedule and actions suspended. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Reject any instruction that conflates preservation with public disclosure, secrecy or ownership. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An object is held but already public; decide access separately while preserving the held version. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- State the decision unit for “Distinguish hold, freeze, retention and access”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 2 OF 13 · Define authority and scope
2. Verify authority and trigger
Holds should identify the authorised office, matter, foreseeable need and mechanism for amendment or release. Archive staff should not invent legal scope.
Evidence record: Preserve signed notice, matter identifier, issuer, date, contacts, urgency, acknowledgement and questions routed for clarification. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Apply a bounded emergency preservation step when needed, then obtain authoritative scope without destroying evidence. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A verbal request arrives after an incident; freeze obvious matching disposal while escalating for written authority. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- State the decision unit for “Verify authority and trigger”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 3 OF 13 · Define authority and scope
3. Translate notice language into object criteria
Terms such as model outputs, communications or forecast decisions must become reproducible criteria across people, dates, projects, systems and versions. Overbroad scope creates cost; narrow scope loses evidence.
Evidence record: Version custodian, keyword, date, object type, project, system, derivative and exclusion criteria with examples. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Test criteria against known responsive and non-responsive objects before full execution. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The matter expands to another catchment; amend scope and record the added boundary. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- State the decision unit for “Translate notice language into object criteria”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 4 OF 13 · Preserve across systems
4. Inventory copies and custodians
Forecast evidence may sit in repositories, notebooks, email, object stores, cold archives, contractors, devices and mirrors. A central catalogue may be incomplete.
Evidence record: Keep system owner, custodian, location, data type, volume, encryption, retention job, backup, mirror and external agreement. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Escalate unknown custody and stop scheduled disposition on reasonably implicated systems until scope is resolved. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A contractor holds calibration files not listed centrally; add custody without assuming transfer rights. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- State the decision unit for “Inventory copies and custodians”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 5 OF 13 · Preserve across systems
5. Stop deletion, overwrite and compaction safely
Disposition can occur through lifecycle jobs, log rotation, database vacuum, version replacement, deduplication and storage optimisation. Disable only the mechanisms affecting scoped evidence.
Evidence record: Record jobs, policies, queues, snapshots, immutable settings, exceptions, test objects and proof that matching records survive. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Verify the stop end to end; a disabled interface setting is insufficient when a backend lifecycle still runs. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A storage migration rewrites objects; preserve original fixity and transformation lineage. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- State the decision unit for “Stop deletion, overwrite and compaction safely”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Worked preservation map
| Object | Location | Normal rule | Hold action |
|---|---|---|---|
| Forecast package F27 | Public repository | Supersede after correction | Preserve bytes; suspend replacement |
| Run logs | Hot storage | Delete after 90 days | Freeze matching dates |
| Cold replica | Archive tier | Integrity audit yearly | Verify fixity and access |
| Analyst notebook | External custodian | Project closeout | Notify and preserve scoped copy |
The governing notice, not this example, determines actual scope.
CHAPTER 6 OF 13 · Control review and release
6. Preserve fixity and chain of custody
Held records must remain attributable and intact. Access and transformations need logs; review copies should derive from protected masters.
Evidence record: Capture object ID, checksum, time, source, collector, storage, permissions, key custody, access and derivative lineage. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Quarantine integrity failures and retain both original evidence and documented repair attempts. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A bit-rot audit finds one replica damaged; repair from verified copy without erasing the incident. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- State the decision unit for “Preserve fixity and chain of custody”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 7 OF 13 · Control review and release
7. Create controlled and privileged review copies
Counsel, auditors or investigators may need searchable, redacted or annotated copies. “Privileged” is a legal determination, not a filename.
Evidence record: Keep request authority, source set, extraction method, search terms, redaction, reviewer access, export, annotation and destruction or return rule. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Separate masters from review copies and apply the governing confidentiality and privilege instructions. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An external expert needs access; verify authority, agreement and least privilege before transfer. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- State the decision unit for “Create controlled and privileged review copies”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 8 OF 13 · Control review and release
8. Separate hold from public release suspension
Some held records can remain public; others may need temporary restriction for rights, privacy, security or investigation integrity. Use a separate release decision.
Evidence record: Record public state, legal or policy basis, harm analysis, authority, start, notice, review date and replacement or tombstone. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Do not remove public material merely because it is held, and do not publish held material merely because preservation is secure. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A corrected public package is ready while the original is held; seek authority for linked release without altering evidence. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- State the decision unit for “Separate hold from public release suspension”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 9 OF 13 · Resolve retention and disposition
9. Handle new records and rolling forecasts
A matter can cover records created after the notice. Forecast systems continuously generate runs, logs and communications, so collection may need automation and periodic validation.
Evidence record: Store prospective rule, start and end triggers, ingestion coverage, missed records, clock and timezone, custodian changes and sampling checks. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Continue prospective preservation until written scope changes; do not assume the last known date ends the obligation. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A forecast service is renamed; update capture rules without losing lineage. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- State the decision unit for “Handle new records and rolling forecasts”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Lift and disposition gate
| Gate | Evidence | If unresolved |
|---|---|---|
| Authority | Written lift or narrowing | Continue hold |
| Completeness | Custodian and system reconciliation | Investigate gap |
| Integrity | Checksums and change ledger | Quarantine |
| Retention | Current schedule and exceptions | Seek records decision |
| Release | Rights and scientific review | Keep restricted |
Return each object to its lawful lifecycle through a recorded decision.
CHAPTER 10 OF 13 · Resolve retention and disposition
10. Resolve conflicts with normal schedules
A hold overrides ordinary disposition for scoped material but should not silently rewrite the authoritative retention schedule. Track the temporary exception and cost.
Evidence record: Link hold to schedule, cutoff, original disposition date, extension, storage impact, duplicate policy and records authority. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Preserve held records while seeking a decision on ambiguous or conflicting requirements. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A permanent archival transfer becomes due during the hold; coordinate custody without ending preservation. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- State the decision unit for “Resolve conflicts with normal schedules”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 11 OF 13 · Resolve retention and disposition
11. Manage multiple holds and overlapping scope
One record can be subject to several matters with different authorities and release dates. Lifting one does not end the others.
Evidence record: Maintain object-to-hold links, precedence, conflicts, shared custodians, independent lift status and minimum remaining obligations. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Release an object from suspension only when every applicable hold and independent retention duty is resolved. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A second audit hold starts during litigation; preserve both lineages and notices. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- State the decision unit for “Manage multiple holds and overlapping scope”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 12 OF 13 · Verify, lift and transfer
12. Reconcile and lift through written authority
A lift can narrow or end the temporary suspension. Inventory systems, custodians and copies; preserve the action record; then return objects to current lifecycle rules.
Evidence record: Keep lift notice, effective time, scope, acknowledgements, collection completeness, integrity, remaining holds, retention schedule and execution receipts. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Do not bulk-delete after a lift; perform object-level disposition review and retain the hold history. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A partial lift excludes one date range; test filters before reactivating lifecycle jobs. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- State the decision unit for “Reconcile and lift through written authority”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
CHAPTER 13 OF 13 · Verify, lift and transfer
13. Prove disposition and release decisions after the hold
Some objects will transfer, remain, publish, restrict, supersede or be destroyed under current authority. Each outcome needs evidence independent of the expired hold.
Evidence record: Record object, current schedule, rights, scientific status, decision, approver, action, checksum, witness and public citation changes. Preserve timestamps, versions, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Close only when systems and custodians are reconciled and unresolved exceptions have owners. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Transfer the method to a public-health data archive with stricter personal-data duties. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- State the decision unit for “Prove disposition and release decisions after the hold”.
- Bind the claim to versions, denominators, missing cases and time boundaries.
- Connect evidence to an owner, bounded action and later verification.
Verification lab: work the decision twice
Translate a fictional notice covering a catchment, date range and model project into object, custodian and system criteria.
Find three disposition paths—log rotation, object lifecycle and version replacement—and design end-to-end hold verification.
Lift one of two overlapping holds, then decide which objects remain frozen, return to retention or require release review.
Limits and misconceptions
A hold is not a public-access decision
Preservation and disclosure follow separate authority.
A date does not automatically lift a hold
Use written authority and reconciliation.
Backup alone is not legal preservation
Scope, integrity, custody and disposition controls matter.
Privileged is not a self-applied label
Follow authorised legal determination and handling.
Questions readers ask
What is a legal hold?
- A temporary suspension of normal disposition because records may be needed for legal, audit or investigative purposes.
What is a preservation freeze?
- The repository action that prevents premature disposition of scoped records.
Can held data remain public?
- Sometimes. Public release is a separate rights, policy, security and scientific decision.
What belongs in a hold inventory?
- Objects, versions, custodians, systems, copies, schedules, lifecycle jobs and external custody.
When can the hold end?
- When authorised written direction narrows or lifts it and remaining obligations are reconciled.
What happens after lift?
- Each object returns to its current lawful retention, access and scientific lifecycle through a recorded decision.
Practise, verify and continue
Design a hold for a forecast archive spanning public packages, 90-day logs, cold replicas and an external analyst notebook. Include criteria, lifecycle stops, fixity, review copies, release decisions and lift reconciliation.
Move the method to an education research archive. Replace hydrological objects while preserving authority, scope, custody, lifecycle suspension, controlled review and post-hold disposition.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
Forecast archive takedown and replacement packages
Forecast archive access, redaction and release
Forecast archive fixity audits
Forecast archive tiered storage and retention
Authoritative sources and scope
NARA policy on holds for operational records
NARA Federal Records Centers freeze process overview
NASA Planetary Data System archive policies
W3C PROV-O recommendation
NARA sources explain United States federal records holds and freezes; they are authoritative examples, not legal advice or a universal rule for eduKate readers. NASA PDS and W3C support archive integrity and provenance. Actual hold authority, privilege, retention, disclosure and disposition depend on the organisation, custody, contracts and jurisdiction.