THE GOLD STANDARD OF INTELLIGENCE · SPECIALIST STUDY
Respond when an RDS successor control fails and heightened review returns
A reinstatement trigger means an assumption behind backlog retirement has failed or become uncertain. The response must protect participants and analysis before debating whether the event is large. It validates the trigger, freezes a trustworthy denominator, quarantines affected devices and cases, accelerates remedies, recalls analytical outputs when their evidence boundary is no longer defensible and repairs ownership as well as technology. Independent changed-context tests decide which scope can return to ordinary control. The incident record preserves what happened, what was repaired and which uncertainties remain.
This guide belongs to the Intelligence subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Validate and contain the trigger · chapters 1, 2, 3
Bound devices, cases and participants · chapters 4, 5
Protect data and analytical outputs · chapters 6, 7, 8
Repair ownership and test recovery · chapters 9, 10, 11
Return bounded scope and learn · chapters 12, 13
The whole problem at a glance
| Incident question | Required evidence | Unsafe shortcut |
|---|---|---|
| Was the trigger valid? | Protected source and rule | Clear the alert |
| Who is affected? | Device and case denominator | Known tickets |
| What must be recalled? | Dataset and output lineage | Latest report |
| What may return? | Independent retest | Owner assurance |
A credible trigger can justify protection before harm or estimator change is proved.
CHAPTER 1 OF 13 · Validate and contain the trigger
1. Preserve and validate the reinstatement trigger
Capture the raw event, threshold, surveillance version, device or case state, alert path, clocks and automated action before resetting or reclassifying it. Test credible false-positive explanations directly.
Evidence record: Retain trigger definition, source, raw logs, fixture or real object, threshold, timestamps, automation, notifications, validation method, alternatives and decision. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Keep protection active until the trigger is shown false or affected scope is safely partitioned. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A delayed beacon produces the alert; verify the local image and interview state before clearing it. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- Define the decision unit for “Preserve and validate the reinstatement trigger”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 2 OF 13 · Validate and contain the trigger
2. Declare an incident and separate evidence roles
Assign incident authority, field lead, participant-protection owner, data manager, statistician, device owner, privacy lead and independent reviewer. Preserve separation between repair and return approval.
Evidence record: Record declaration, severity, role map, access, evidence custodian, decisions, communications, conflicts, review cadence and stop authority. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: No owner closes its own repair without independent evidence for affected participants and analytical outputs. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The device team restores beacons, but participant and analysis owners still decide remedies and releases. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- Define the decision unit for “Declare an incident and separate evidence roles”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 3 OF 13 · Validate and contain the trigger
3. Stabilise ordinary and heightened controls
Confirm which daily reconciliation, device quarantine, manual release review, remedy escalation and site restrictions were reinstated. Prevent duplicate actions and unsafe overrides.
Evidence record: Capture control version, scope, successful and failed actions, overrides, credentials, queues, side effects, continuity effect and rollback capability. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Overrides need named authority, expiry, minimum participant exposure and retrospective review. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An urgent field session uses verified spare devices rather than disabling quarantine on the unknown handset. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- Define the decision unit for “Stabilise ordinary and heightened controls”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 4 OF 13 · Bound devices, cases and participants
4. Freeze and reconcile the device denominator
Join issue, image, beacon, sync, interview, coupon, return, repair, loss and warehouse evidence. Classify devices as affected, plausible, verified unaffected or unknown.
Evidence record: Store stable device ID, cohort, owner, image, last beacon, local data, interviews, custody, exceptions, evidence sources and classification confidence. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Unknown devices stay quarantined; verified unaffected cohorts may continue with documented monitoring. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A warehouse handset belongs to an earlier wave but contains a current account; treat it as plausibly affected. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- Define the decision unit for “Freeze and reconcile the device denominator”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 5 OF 13 · Bound devices, cases and participants
5. Bound participant and case scope without overexposure
Trace interviews, consent modules, incentives, tests, coupons and remedy duties through participant-safe identifiers. Minimise access while retaining a reconstructable scope.
Evidence record: Record participant-safe key, device, site, time, module versions, consent, test and incentive state, exposure, contact limits, remedy and privacy authority. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Protect and remedy plausible cases before waiting for perfect lineage; do not disclose identity beyond authorised roles. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A participant saw an old consent page but completed the current questionnaire; route a consent remedy without broadening unrelated access. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- Define the decision unit for “Bound participant and case scope without overexposure”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Worked reinstatement register
| Observation | Immediate action | Participant or analytical route | Closure proof |
|---|---|---|---|
| Old image reconnects | Quarantine device | Trace interviews | Image retest |
| Remedy queue stale | Escalate cases | Contact safeguards | Receipts complete |
| Grace policy drift | Suspend exception | Review subgroup use | Policy restored |
| Output used held data | Recall release | Rerun and notify | Decision repaired |
Removing an item from a dashboard does not complete participant or analytical obligations.
CHAPTER 6 OF 13 · Protect data and analytical outputs
6. Accelerate remedies with safe contact rules
Prioritise clinical or testing results, consent correction, payment, withdrawal, complaint and data-use obligations by consequence and deadline. Separate participant support from staff investigation.
Evidence record: Maintain obligation, deadline, approved contact, attempts, language, safety assessment, remedy offered, acceptance or decline, receipt, escalation and unresolved limits. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: An administrative close cannot substitute for participant receipt or a documented safe-contact limit. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A participant cannot be contacted safely; retain the obligation and approved alternative rather than marking no response as completion. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- Define the decision unit for “Accelerate remedies with safe contact rules”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 7 OF 13 · Protect data and analytical outputs
7. Quarantine affected data with reversible labels
Tag records and derivative datasets by device, protocol, consent, coupon and remedy state. Prevent routine release while preserving raw evidence, correction chronology and controlled analysis access.
Evidence record: Store dataset and record versions, quarantine reason, scope, access, transformations, copied outputs, exceptions, decision owner and release conditions. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Do not delete or overwrite questionable records; preserve the state investigators and participants actually encountered. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A mixed-module interview remains immutable while an analytical copy carries an explicit exclusion and sensitivity flag. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- Define the decision unit for “Quarantine affected data with reversible labels”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 8 OF 13 · Protect data and analytical outputs
8. Recall analytical outputs by lineage and use
Identify reports, tables, dashboards, models and decisions built from affected versions. Distinguish distribution, viewing, reliance and changed outcome.
Evidence record: Link output version, dataset, code, weights, release, recipients, access, decision use, alternative evidence, consequence, recall notice and acknowledgement. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Recall when the published claim exceeds current evidence; later rerun may confirm, revise or withdraw it. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A dashboard used a held dataset but a public report did not; recall the dashboard without inventing broader exposure. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- Define the decision unit for “Recall analytical outputs by lineage and use”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 9 OF 13 · Repair ownership and test recovery
9. Rerun estimators and repair decisions transparently
Recompute inclusion, network variables, weights, seeds, exclusions and sensitivity under the corrected evidence. Preserve original and repaired results with bounded interpretation.
Evidence record: Retain code and environment, input versions, estimator settings, diagnostics, comparisons, uncertainty, reviewer, notices, recipient receipts and decision remedy. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Do not claim no effect from one aggregate comparison; test the strata and outcomes relevant to the release. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The overall estimate is stable but one site changes materially; correct the site conclusion and preserve the national result boundary. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- Define the decision unit for “Rerun estimators and repair decisions transparently”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Bounded-return gate
| Gate | Pass evidence | Remain heightened when |
|---|---|---|
| Scope | Denominator reconciled | Unknown device |
| People | Remedies complete | Unsafe contact |
| Analysis | Outputs rerun | Lineage gap |
| Ownership | Successor acts | Authority gap |
A different site or device cohort can remain under ordinary control when its evidence is intact.
CHAPTER 10 OF 13 · Repair ownership and test recovery
10. Find and repair the ownership failure
Investigate expired roles, inaccessible systems, split authority, weak leave cover, vendor gaps, training drift and unclear hand-offs that allowed the trigger condition.
Evidence record: Store role history, permissions, calendars, alerts, acknowledged duties, staff changes, vendor contacts, escalation attempts, missed actions, cause evidence and repairs. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: A renamed owner or new procedure is not repair until the successor operates the control with access and stop authority. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The data owner received alerts but could not quarantine devices; redesign and exercise joint authority. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- Define the decision unit for “Find and repair the ownership failure”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 11 OF 13 · Repair ownership and test recovery
11. Run independent changed-context retests
Use hidden safe fixtures across a different site, device cohort, module, grace condition and release path. Observe detection, quarantine, participant routing, analytical hold and escalation.
Evidence record: Record reviewer independence, scenario, fixture, expected timing, observed actions, permissions, false results, misses, remedies, rerun and retest. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: A test passes only for declared scope; repeating the incident artefact alone cannot validate the repair. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Use a delayed reconnect from a spare device and an old language module rather than the original handset. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- Define the decision unit for “Run independent changed-context retests”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 12 OF 13 · Return bounded scope and learn
12. Authorise bounded return in stages
Restore device use, interviews, sync, dataset processing and output release separately. Name scope, evidence, residual exceptions, monitoring window and automatic triggers for each stage.
Evidence record: Publish authorised cohorts, sites and functions, passed gates, exclusions, controls, residuals, owners, expiry, next review and automatic reinstatement thresholds. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Pressure in one function cannot widen unrelated stages; unknown scope remains heightened. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Resume verified-device interviews while release review stays heightened until estimator reruns pass. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- Define the decision unit for “Authorise bounded return in stages”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
CHAPTER 13 OF 13 · Return bounded scope and learn
13. Close into surveillance and cross-site learning
Transfer updated denominators, remedy state, data labels, owner access, exercises and reopening triggers to ordinary operations. Share mechanism lessons without exposing participants.
Evidence record: Retain chronology, cause, controls, participant outcomes, analytical repairs, accepted scope, owner operation, first surveillance cycle, lessons and portfolio linkage. Preserve source, time, version, denominator, exclusions, failed checks, burden and uncertainty so a later reviewer can reconstruct the decision rather than inherit confidence.
Decision rule: Close only after successor owners operate the next cycle; recurrence automatically reopens the mechanism. Name the authorised owner, bounded scope, deadline, stop condition, remedy and verification window. Completion requires a changed-context test of the mechanism being protected, not only a closed task.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A second site shows the same grace drift; add a system-wide prevention item rather than treating it as unrelated. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- Define the decision unit for “Close into surveillance and cross-site learning”.
- Bind each conclusion to a versioned denominator and observation window.
- Connect evidence to an owner, protective action and reopening trigger.
Contents · Previous chapter · Return to the Intelligence guide
Verification lab: work the decision twice
Simulate a delayed beacon from an old-image device, preserve evidence and partition affected, plausible, unaffected and unknown scope.
Trace one mixed-module interview through participant remedy, data quarantine, estimator rerun, output recall and decision repair.
Run an independent changed-context exercise and decide which devices, sites, processing and outputs can return at each stage.
Limits and misconceptions
A trigger is not proof of harm
It is evidence that a protection assumption failed or became uncertain.
Quarantine is not deletion
Preserve raw states and correction chronology.
A stable overall estimate can hide local change
Test relevant sites, groups and decisions.
Return should be staged
Device, interview, processing and release controls can recover at different times.
Questions readers ask
When does a trigger become an incident?
- When it credibly challenges a retired-control assumption and requires coordinated protection, investigation or repair.
Should all devices stop?
- Only affected and plausibly affected cohorts unless the denominator or failure is systemic.
What participant remedies come first?
- Those with clinical, consent, payment, withdrawal, safety or data-use consequences and time limits.
When should outputs be recalled?
- When their claim or decision boundary is no longer supported by the current evidence.
Who approves return?
- An authorised owner informed by independent evidence, not solely the team that performed repair.
What closes the incident?
- Completed remedies, analytical repair, exercised successor ownership, bounded return and live reopening triggers.
Practise, verify and continue
Investigate a reinstatement trigger, reconcile the device and participant denominator, accelerate remedies, recall one affected output, repair ownership and run an independent staged-return test.
Apply the method to offline public-health, humanitarian or field-research collection. Preserve participant protection, device lineage, analytical recall and the distinction between containment and bounded return.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
RDS post-backlog-retirement surveillance
RDS exception-backlog ownership transfer
RDS offline-release field surveillance
RDS stale-protocol incident response
Authoritative sources and scope
CDC NHBS-PWID 2024 Operations Manual
CDC National HIV Prevention Program monitoring and NHBS resources
CDC data security, confidentiality and release principles
CDC National HIV Behavioral Surveillance overview
CDC materials support standardised RDS operations, incident reporting, monitoring, data management, confidentiality, release controls and participant-aware practice. They do not prescribe this reinstatement framework. Device, consent, payment, testing, privacy, safety, ethics and estimator decisions require the actual protocol and authorities.