Organisation Portal
Sampling and Holds
Three things an organisation needs once its studios deliver with agents: a second look at a share of completed work, a way to hold records for a legal matter, and a stated retention period for evidence.
Sample reviews
On Organisation → Guardrails, a policy can name a share of completed work packages and an organisation reviewer role. When a work package born under that policy version completes, the server decides whether it is one of the sampled ones. A member of the named role — as the package’s studio maps it to one of its own named reviewer roles — then records what they found: Confirmed, or a Concern with a note.
A sample review never blocks. A pending sample or a concern does not stop a work package being released or deployed. It is shown on Organisation → Sampling and Holds, on the package’s passport and on its release, so that someone follows it up.
How the server chooses — once, when the package completes, from values the server itself made and keeps with the package. A studio cannot predict the choice, choose it, or have it made again; and anyone who can read the package can recompute it. The page says how many packages were selected out of how many the policy looked at.
Who gives the verdict — only a member of the named role. Being the studio’s owner or a reviewer is not enough. A studio of one can map itself into the role and finish its own samples; the verdict then says the reviewer also completed the package.
Nobody can decide — if a studio has not mapped the role to a named role with members, or answers it with any human in the loop, nobody there can record a verdict and the sample stays pending. The list says so.
A concern — can later be confirmed as resolved, with a note saying how. The concern stays on the record.
Legal holds
A legal hold on a work package or a release stops its records being deleted: the artefact itself, its studio, the pages of a held work package, the DPIA a held release names, the intent a held work package belongs to and the repository connection its commits came from. Each of those is refused while the hold is in force, naming the hold. It stops nothing else — work, approval, release and deployment go on as usual.
Who places one — a studio’s owner, from the work package or the release; or the organisation’s owner or an administrator, from Sampling and Holds, by naming the studio and the artefact’s reference (for example WP-12 or REL-3). A written reason is required. The artefact’s evidence ledger and its passport record that a hold was placed, when and by whom, and never the reason.
Who sees the reason — a reason the organisation wrote is shown to the organisation’s administrators only: the studio’s owner and members see that the hold is in force, who placed it and when, and it is kept off the studio’s audit log. A reason a studio’s owner wrote is shown to that owner, to whoever may read the studio’s audit log, and to the organisation’s administrators.
What a hold does not do — it does not lengthen the audit log’s own retention: audit entries about the held artefact still expire when your audit retention runs out. If a matter will outlast that, export the audit log.
Who lifts one — a hold the organisation placed is lifted by the organisation, never by the studio. A hold a studio’s owner placed can be lifted by that owner or by the organisation.
Releasing a studio — a studio cannot be released from the organisation while the organisation holds one of its artefacts. Lift the organisation’s holds first.
Evidence retention
The organisation’s owner can declare the minimum number of days the organisation keeps evidence for. It can never be shorter than the organisation’s audit retention. Declaring a period, or lengthening one, needs the Enterprise contract; shortening or withdrawing one does not.
It is a declaration, not a deletion schedule. Nothing deletes evidence today. The evidence ledger and issued passports are kept for as long as the service holds them, whatever is declared, and also after a studio is deleted. The declaration is recorded, audited and shown to your studios.
Reading a large organisation
The lists are read from each studio a part at a time, so they cannot drift from the records. A studio that has left the organisation, or whose owner is not a member of it, is listed but not read. Reading this page, and placing or lifting a hold, need no Enterprise contract.
