Sample Reviews, Legal Holds, Bills of Materials and Retention

Four things that sit beside the gates: a second look at a share of completed work, a hold that stops records being deleted, a bill of materials recorded as evidence, and how long evidence is kept.

Sample review

An organisation’s guardrail policy can name a share of completed work packages and one of its reviewer roles. When a work package created under that policy completes, the server decides whether it is one of the sampled ones. If it is, a member of the named role records what they found on the work package’s Passport tab: Confirmed, or a Concern with a note.

A sample review never blocks. A pending sample or a concern does not stop a work package being released or deployed, and no pipeline check counts it. It is shown on the passport, on the release and to the organisation, so that someone follows it up.

The choice is the server’s, made once. It is made when the package completes, from values the server itself produced and keeps with the package. A studio cannot predict it, choose it or have it made again, and anyone who can read the package can recompute it.

Who records the verdict — a member of the organisation’s role, as your studio maps it to one of its own named roles on Human Roles. Being the studio’s owner or a reviewer is not enough, and any human in the loop does not count.

A studio of one can map itself into the role and finish its own samples. The verdict then says the reviewer also completed the package.

If nobody holds the role, the sample stays pending and the organisation’s list says why.

A concern can later be confirmed as resolved, with a note. The concern stays on the record.

A studio with no organisation has no sample reviews: its work packages complete exactly as before.

Legal hold

A legal hold on a work package or a release stops its records being deleted. The studio’s owner places one from the work package’s Passport tab or from the release, with a written reason. No organisation and no particular plan is needed.

While a hold is in force
Deleting the held work package or release	Refused
Deleting the studio	Refused
Deleting a page of a held work package’s plan	Refused
Deleting the DPIA a held release names, or the intent a held artefact belongs to	Refused
Deleting the repository connection its commits came from	Refused
Working on the package, approving, releasing, deploying, archiving, rolling back	Unaffected
Rotating or revoking a deploy token	Unaffected

Who lifts it — a hold the studio’s owner placed is lifted by that owner or by the organisation. A hold your organisation placed is lifted by the organisation.

The reason is not evidence. The passport and the ledger record that a hold was placed or lifted, when and by whom. The reason itself is kept off both, because it will often name people or a case, and a passport is signed and shared. Members see that a hold is in force; a reason the organisation wrote is shown to the organisation’s administrators only.

What a hold does not do — it does not lengthen the audit log’s retention. Audit entries about the held artefact still expire when your audit retention runs out. If a matter will outlast that, export the audit log.

What your organisation sees of sample reviews and holds, and how it places a hold or declares retention, is in Sampling and Holds (Organisation Portal).

Bills of materials

A release lists the software bills of materials a pipeline has reported for it: the commit each describes, its format and the SHA-256 of the document. How a pipeline reports one is in Wire a Pipeline to the Passport.

Where your organisation’s guardrail policy requires one, a release is refused at approval and again at release until every work package’s delivered commit has one, and the refusal names each package that has none. On the release’s passport the requirement appears as required rows of the release gate, so every verifier — the pipeline’s check included — counts a missing one as unmet. A release with no such rule has no such rows.

How long evidence is kept

Nothing deletes evidence. The evidence ledger and issued passports have no expiry and the application cannot delete them. They are kept for as long as the service holds them, including after a studio is deleted.

An organisation’s owner can declare the minimum time the organisation keeps evidence for. That is a statement, recorded and audited and shown to its studios. It is not a deletion schedule, and declaring a period removes nothing when the period ends.

All Guardrails, Evidence & Passport documentation

Build v0.3.2 · deployed 2026-10-19T23:52:31Z