P167 — AIEP — Evidence Archival and Retention Policy Protocol

Publication Date: 2026-03-27 Status: Open Source Prior Art Disclosure Licence: Apache License 2.0 Author/Organisation: Phatfella Ltd Schema: AIEP_OS_SPEC_TEMPLATE v1.0.1 — https://aiep.dev/schemas/aiep-os-spec-template/v1.0.1

Framework Context

[0001] This disclosure operates within an Architected Instruction and Evidence Protocol (AIEP) environment as defined in United Kingdom patent application number GB2519711.2, filed 20 November 2025, the entire contents of which are incorporated herein by reference.

[0002] The present disclosure defines a protocol for governing the archival, retention, and eventual disposition of evidence artefacts within AIEP-governed evidence infrastructure through a structured RetentionPolicy schema, a RetentionScheduler component, a tiered archival storage model, and a DispositionRecord schema enabling complete auditability of all archival and deletion events throughout the evidence lifecycle.

Field of the Disclosure

[0003] This disclosure relates to evidence archival and retention policy protocols for governed artificial intelligence reasoning systems.

[0004] More particularly, the disclosure concerns a RetentionPolicy schema defining retention periods, archival tiers, and disposition triggers; a RetentionScheduler applying policies to evidence artefacts at configurable intervals; a three-tier storage model (Active, Archive, Permanent Hold) governing where an artefact resides in the infrastructure; and DispositionRecords providing tamper-evident records of all archival and purge events.

Background

[0005] AIEP evidence corpora accumulate artefacts continuously. Without a formal retention protocol, corpora grow without bound, including artefacts that are no longer relevant to current reasoning tasks, have been superseded by updated versions, or are subject to regulatory purge obligations (e.g. data protection rights of erasure). Uncontrolled corpus growth increases storage costs, degrades retrieval performance, and may expose organisations to regulatory liability for retaining data beyond permitted periods.

[0006] Retention must be balanced against the AIEP integrity principle: the provenance chain (P150) and dual-ledger record (P80) for every artefact must be preserved even when the artefact content is archived or purged, ensuring that the reasoning history is fully auditable even after the underlying evidence has been removed from active storage. Evidence purge must therefore be distinguished from ledger record purge — the former may be legally and technically permissible; the latter would destroy the audit trail and is not permitted.

[0007] Different evidence artefact categories require different retention treatment: peer-reviewed research has indefinite scholarly value; news content may have a retention period of months; personal data in evidence may be subject to mandatory purge; evidence cited in finalised reasoning outputs supporting legal or regulatory decisions should be placed on permanent hold.

Summary of the Disclosure

[0008] Storage Tiers: Three storage tiers are defined:

• Active — fully indexed, immediately retrievable; all artefacts begin in this tier
• Archive — content preserved but removed from primary index; retrievable within a configurable latency (default: 60 seconds); artefacts in this tier are excluded from real-time streaming (P158) and evidence sampling (P164) by default
• Permanent Hold — artefact and its full provenance chain (P150) are preserved indefinitely and cannot be purged; used for evidence cited in legally binding or regulatory reasoning outputs

Disposition Actions (terminal):

• PURGE — artefact content is deleted; ledger record (P80) and DispositionRecord are retained; the DEID Registry (P162) entry is updated to evidence_status = PURGED
• ANONYMISE — personal data fields are redacted (P173) and the artefact is returned to Active tier in anonymised form; original content is deleted

[0009] RetentionPolicy Schema:

• policy_id — SHA-256 of canonical serialisation of all other fields
• scope_selector — evidence selection criteria: taxonomy_filter (P160), source_domain, or deid_list
• active_retention_days — number of days to retain in Active tier (null = indefinite)
• archive_retention_days — number of days to retain in Archive tier before Disposition (null = indefinite)
• disposition_action — PURGE or ANONYMISE or PERMANENT_HOLD
• hold_triggers — list of conditions that override disposition and place artefact on PERMANENT_HOLD: CITED_IN_LEGAL_OUTPUT, CITED_IN_REGULATORY_OUTPUT, MANUAL_HOLD
• policy_owner — node fingerprint (P46) of administering node
• policy_version — semantic version
• jurisdiction_basis — free text reference to the regulatory or organisational authority for this policy

[0010] RetentionScheduler: The RetentionScheduler evaluates each active EvidenceNode against all applicable RetentionPolicies at a configurable interval (default: daily). For each artefact, it determines: (a) whether the artefact’s time in Active tier has exceeded active_retention_days, triggering a move to Archive tier; (b) whether the artefact’s time in Archive tier has exceeded archive_retention_days, triggering disposition; (c) whether any hold_triggers are active, in which case disposition is blocked and PERMANENT_HOLD is applied. Where multiple RetentionPolicies match the same artefact, the most restrictive policy applies (longest retention period; hold triggers from any policy are cumulative).

[0011] DispositionRecord Schema: A DispositionRecord is created for each archival or disposition event:

• disposition_id — SHA-256 of canonical serialisation of all other fields
• evidence_id — the DEID of the affected artefact
• action — MOVE_TO_ARCHIVE, MOVE_TO_ACTIVE, PURGE, ANONYMISE, PERMANENT_HOLD
• policy_id — the RetentionPolicy that triggered this action
• actioned_at — ISO 8601 timestamp
• actioned_by — SCHEDULER or node operator fingerprint for manual actions
• hold_trigger_reason — populated for PERMANENT_HOLD actions

[0012] Ledger Anchoring: All DispositionRecords are appended to the DISPOSITION partition of the Deterministic Dual-Ledger Memory Substrate (P80). The ledger record for an artefact is never purged, even when the content is purged. This ensures that the reasoning history — which references evidence by DEID — remains traceable back to a ledger record confirming what happened to the artefact, even after its content is no longer available.

[0013] Legal Hold Override: Any governance operator or authorised reasoning output with CITED_IN_LEGAL_OUTPUT flag may place a specific DEID on legal hold, overriding any RetentionPolicy disposition trigger. Legal hold can only be lifted by an explicit release action by an operator with governance-tier permissions (P89), recorded in the ledger.

ASCII Architecture

EvidenceNode (Active)
        │
        │  daily RetentionScheduler evaluation
        ▼
┌────────────────────────────────────┐
│  RetentionPolicy Matcher           │
│  scope_selector → applicable policy│
│  hold_triggers evaluated           │
└──────────────┬─────────────────────┘
               │
   ┌───────────┼─────────────────────┐
   │           │                     │
   ▼           ▼                     ▼
WITHIN      MOVE TO               PERMANENT
ACTIVE      ARCHIVE               HOLD
PERIOD      (60s latency          (disposition
            retrieval)             blocked)
               │
               │  archive_retention_days expired
               ▼
     ┌─────────┴──────────┐
     │                    │
     ▼                    ▼
   PURGE               ANONYMISE
(content deleted,    (PII redacted,
 ledger retained)    returned Active)

Operational Detail

[0014] Reasoning Output Integration: Where a reasoning chain produces a ReasoningOutput citing evidence that is subsequently scheduled for purge, the CITED_IN_LEGAL_OUTPUT or CITED_IN_REGULATORY_OUTPUT hold trigger is activated automatically if the ReasoningOutput is tagged with legal or regulatory significance by the Governance Layer (P89). The RetentionScheduler checks for these hold triggers before executing any disposition action.

[0015] Policy Priority Chain: Where no RetentionPolicy explicitly covers an artefact, the default policy is active_retention_days = null, archive_retention_days = null, disposition_action = null (indefinite retention in Active tier). Operators are expected to define at least jurisdiction-level default policies covering broad taxonomy categories.

[0016] Restore from Archive: Archived artefacts may be explicitly restored to Active tier by a requesting node or operator. Restoration is recorded as a MOVE_TO_ACTIVE DispositionRecord. Restored artefacts restart their Active retention period from the restoration timestamp.

Claims-Exclusion Notice

This specification is published as open-source prior art. No patent claims are asserted by the author in respect of the mechanisms described. Any third party seeking to patent mechanisms substantially equivalent to those described herein is placed on notice of this prior art disclosure.