THE GOLD STANDARD OF HYDROLOGY · SPECIALIST STUDY
Preserve enough evidence to rerun a legacy forecast without pretending that a later reconstruction is the original issue-time product
A decommissioned hydrological forecast system can remain scientifically and operationally important. Analysts may need to reproduce a warning, compare an upgrade or explain what users received during an event. That requires more than keeping final files. Inputs, model binaries, configurations, dependencies, random seeds, observations, publication state and access decisions must form a verifiable chain—while later corrections remain clearly distinct from issue-time truth.
This guide belongs to the Hydrology subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Define the reconstruction claim · chapters 1, 2, 3
Capture artefacts and environment · chapters 4, 5
Rerun with versioned observations · chapters 6, 7, 8
Validate and compare · chapters 9, 10, 11
Govern access and retention · chapters 12, 13
The whole problem at a glance
| Question | Evidence | Unsafe shortcut |
|---|---|---|
| What was originally issued? | Immutable product, timestamp, lineage and recipient path | Regenerating and overwriting |
| Can it be rerun? | Inputs, code, environment, configuration and seed | Keeping source code alone |
| Which truth verifies it? | Observation vintage, revision and quality flags | Using today’s observations silently |
| Is the archive intact? | Checksums, manifests, fixity audits and custody | Trusting a filename |
Original issue, exact rerun, best-effort rerun and modern reinterpretation are different products.
CHAPTER 1 OF 13 · Define the reconstruction claim
1. Define the reconstruction question before opening the archive
Decide whether the goal is to show what users received, reproduce bytes, reproduce scientifically equivalent values, verify skill with a historical observation vintage or reinterpret the event using modern knowledge. Each claim needs different evidence. Write acceptance tolerances and allowed substitutions before the rerun so success is not redefined after seeing discrepancies.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Change the question from incident accountability to model research; retain the original chronology but allow a separately labelled modern analysis. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 2 OF 13 · Define the reconstruction claim
2. Preserve the original issued product and chronology
Archive the exact disseminated file, API response or message with issue time, valid times, status, lineage, correction notices and recipient route. Never overwrite it with a rerun. If the original is missing, document the gap and the evidence used to bound what was likely issued; a reconstruction cannot retroactively become the original.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A corrected product was sent two hours later; preserve both versions and the communication sequence. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 3 OF 13 · Define the reconstruction claim
3. Build a manifest of every required artefact
List meteorological forcing, hydrological states, observations available at issue time, model and postprocessor code, parameters, calibration, basin topology, libraries, operating system, compiler, container, random seed, scheduler settings and publication transformations. Record identifiers, locations, licences, owners and checksums. Dependencies outside the archive need explicit substitution rules.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A proprietary forcing archive cannot be redistributed; preserve identifiers, licence route and controlled-access retrieval evidence. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 4 OF 13 · Capture artefacts and environment
4. Capture an executable environment, not source alone
Store signed container images or virtual environments, package locks, compiler and system libraries, architecture and entry commands. Native numerical differences can arise from hardware, parallel order and library versions. Preserve a minimal trusted runtime and document whether network access is disabled, which external services are mocked and how secrets are injected without being archived.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Move the archive from x86 to ARM hardware; test numerical tolerance and record the platform deviation. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 5 OF 13 · Capture artefacts and environment
5. Version configurations and hidden operational defaults
Configuration includes command-line flags, environment variables, scheduler resources, time zones, locale, file ordering, missing-data rules, ensemble truncation, calibration window and fallback mode. Capture generated configurations after templating. A repository default from today is not evidence of the value that production used years ago.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A daylight-saving rule changes; preserve UTC issue conventions and the original time-zone database where relevant. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
Worked reconstruction states
| Product | Inputs and environment | Observation use | Label |
|---|---|---|---|
| Original | Issue-time production | None required | Original issued forecast |
| Exact rerun | Archived matching artefacts | None or archived vintage | Bitwise or tolerance-qualified rerun |
| Scientific rerun | Equivalent environment with declared differences | Versioned vintage | Reproduced with deviations |
| Retrospective analysis | Modern code or corrected data | Latest or chosen vintage | New analysis, never original |
A checksum match is meaningful only for the exact byte object it names.
CHAPTER 6 OF 13 · Rerun with versioned observations
6. Preserve inputs with lineage and fixity
Package or reference every input at the granularity needed for rerun, with source, retrieval time, processing level, subset, transformation and checksum. NASA Earthdata guidance emphasises provenance, dataset versions and transparent use. Run scheduled fixity audits, keep custody events and repair corrupted replicas only from a verified independent copy.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A dataset releases a corrected granule under a similar name; bind the original version and checksum rather than resolving “latest.” The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 7 OF 13 · Rerun with versioned observations
7. Represent observation vintages and revisions
Forecast verification depends on what is treated as truth. Gauges, rating curves, quality flags and merged products can be revised after issue. Keep issue-time observation availability, first operational verification vintage and later authoritative vintages with release dates. Never mix them silently; report how conclusions change across vintages.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A flood rating curve is revised retroactively; rerun verification against both named vintages and explain the difference. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 8 OF 13 · Rerun with versioned observations
8. Run in a quarantined and deterministic workflow
Copy artefacts into a controlled workspace, verify checksums, block unintended network calls, record resource limits and set seeds. Execute from a machine-readable manifest and capture standard output, errors, generated files and environment fingerprint. If nondeterminism is intrinsic, define distributional or tolerance-based acceptance before comparing.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A remote API is unavailable; replay its archived response and label the substitution boundary. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 9 OF 13 · Validate and compare
9. Validate bitwise, numerical and semantic equivalence
Bitwise equality proves identical bytes but may be impossible across numerical environments. Numerical equivalence uses predeclared absolute, relative or distributional tolerances. Semantic equivalence checks that locations, units, valid times, ensemble meaning and decisions match. A file can pass a numeric tolerance while using the wrong time zone or basin mapping.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Change compression and metadata order without changing values; separate byte mismatch from scientific equivalence. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
Retention and access matrix
| Asset | Reason | Control |
|---|---|---|
| Issued products | Public and decision history | Immutable archive and fixity |
| Inputs and observations | Reconstruction and verification | Licence and privacy tiers |
| Executable environment | Method reproducibility | Signed images and controlled runtime |
| Logs and decisions | Incident chronology | Retention schedule and legal hold |
| Credentials and secrets | No scientific value as live secrets | Exclude; preserve configuration references |
Reproducibility never requires publishing active credentials.
CHAPTER 10 OF 13 · Validate and compare
10. Compare original, rerun and retrospective products
Create a three-way table for original issue, reconstructed rerun and any modern retrospective. Attribute differences to input version, environment, nondeterminism, bug fix, observation revision or unknown. Preserve failed attempts. Do not tune the rerun until it matches; every intervention must be declared and its effect measured.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Discover a historical bug; reproduce it for accountability, then fix it only in a separately labelled modern run. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 11 OF 13 · Validate and compare
11. Test archive recovery and organisational memory
Schedule sampled restorations covering ordinary, extreme and dependency-heavy cases. A checksum catalogue that nobody can locate, decrypt or legally access is not a working archive. Measure retrieval, environment start, rerun success and evidence completeness, and rotate responsibility without relying on one retired engineer’s memory.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The primary archive region is unavailable; restore from the independent replica and verify custody plus checksums. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 12 OF 13 · Govern access and retention
12. Govern access, licences and sensitive data
Classify public outputs, licensed forcing, sensitive locations, security logs, personal contacts and executable code separately. Apply least privilege, time-limited approval, logged exports and safe analysis environments. Reproducibility does not justify distributing restricted data or live credentials; publish manifests and transformation descriptions where raw access is limited.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A collaborator’s licence expires; retain the evidence record while revoking data access and offering an approved derived product. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
CHAPTER 13 OF 13 · Govern access and retention
13. Set retention, disposal and evidence-transfer rules
Tie retention to scientific, warning, contractual, legal and public-accountability duties. Name owners, review dates, legal holds, archival formats, migration checks and disposal approval. When formats or storage move, verify checksums and rerun a representative case. At eventual disposal, retain the manifest, decision and limits so future readers know what can no longer be reconstructed.
Build the evidence record around the decision, not around the convenience of the software. Name the unit observed, the version or policy in force, the time boundary, the numerator and denominator, exclusions, missing cases and the person authorised to act. Preserve raw observations separately from interpretation. That separation lets a later reviewer distinguish a changed world from a changed judgement.
Convert the finding into a bounded action. Predefine the trigger, permitted response, owner, expiry, rollback and verification window. Keep one worked case that passes and one that fails. A system which stores only successful cases cannot demonstrate that its control detects the failure it was designed to contain.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Migrate container and data objects to new storage; run fixity, access and representative reconstruction before closing the old copy. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- State the decision and measurement unit in one sentence.
- Preserve version, timing, denominator, exclusions and missing-case evidence.
- Connect the finding to a bounded action, rollback and later verification.
Verification lab: work the decision twice
Select one historic flood forecast. Verify the issued file checksum, restore forcing, state, code, environment and configuration, rerun offline and compare bytes, numbers, units, times and threshold decisions.
Use two observation vintages around a rating-curve revision. Show how verification changes while the original forecast remains fixed, and label both conclusions by vintage.
Remove access to one licensed dependency and one retired package repository. Exercise controlled retrieval or substitution, report what remains exact and what becomes best-effort.
Limits and misconceptions
Source code alone is not a reproducible system
Inputs, environment, configuration and operational transformations also matter.
A rerun is not the original issued forecast
Chronology and dissemination state must remain distinct.
Checksum equality is object-specific
It proves byte identity for the named object, not semantic correctness.
Latest observations are not timeless truth
Vintages and revisions can change verification conclusions.
Questions readers ask
What should be archived?
- Issued products, inputs, lineage, environment, configuration, observations, logs, notices and checksums at the level the reconstruction claim needs.
Must reruns be bitwise identical?
- Only when that is a stated feasible claim; otherwise use predeclared numerical and semantic tolerances.
Which observations should verify the forecast?
- A named vintage appropriate to the question, often with sensitivity across operational and later authoritative versions.
Can licensed inputs remain reproducible?
- Yes through controlled references, access routes and manifests, though public redistribution may be prohibited.
Should a historical bug be fixed?
- Reproduce it for history, then run the fix as a separate retrospective product.
How is archive health tested?
- Through fixity audits, access restoration and representative end-to-end reruns.
Practise, verify and continue
Create a reconstruction package for one basin and issue: immutable original, manifest, checksums, inputs, executable environment, configurations, two observation vintages, offline rerun, equivalence report, access tier and retention owner.
Move the package to new hardware and storage while a data licence expires. Revalidate tolerances, fixity, access governance and a representative rerun before retiring the former archive.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
Post-cutover postprocessor surveillance and incident replay
Forecast-system transitions and safe decommissioning
Reforecast postprocessing leakage and honest holdout skill
Authoritative sources and scope
ECMWF S2S reforecast archive documentation
ECMWF hindcast access and archive guidance
NASA Earthdata data-use and citation guidance
NASA Earth Science data product development guidance
The sources support reforecast archives, model-version context, provenance, data versions and reproducibility. Retention periods, tolerances, access tiers and worked incidents are illustrative; agencies must apply their licences, records schedules, warning duties and security policies.