MAP · CONTROL · RECONCILE
Governance gates: holds and retention exceptions
Follow actual fictional records through primary storage, a backup, an export and a restore.
Scroll the diagram horizontally to inspect every label. The panels below give the same state as text.
Your experiment
A 20-day retention window sweeps primary storage on days 9 and 20, and a billing hold exempts one record. Check which records each gate removes or keeps, then compare what remains in the backup and the export.
Play takes one minute at 1×. Pause, step or scrub the computed history. Input changes reset the experiment without autoplay. Red cards identify a previously deleted record that returned from backup.
Export snapshot
An export already copied to another destination is not automatically revoked by erasing the source.
Decision trace
Complete record and tombstone inventory
Technical teaching fixture, not legal advice, a GDPR/DPDP compliance assessment or an operational data-deletion service. All records and identities are fictional. The modeled policies are explicit choices, not statutory deadlines or legal bases. Verification and consent are switches, not identity checks or valid consent collection. Retention runs at days 9 and 20. Requested deletions schedule one backup purge; retention-expired backup copies remain visible and require a separate real-world policy. Tombstones block restoration; they are not anonymization. Holds are a fixture exception, not a legal determination. Real systems also need authorization roles, downstream deletion, backup lifecycle, notices, audit protection and jurisdiction-specific review. No personal information or external service is accessed. Official AICassindra learning resources.
Two gates with exceptions
Requested deletion and time-based retention are the two gates that remove records here. The opening Retention window is 20 days, and sweeps run on days 9 and 20, removing any primary record whose age plus the day reaches the window. Hold billing records against deletion is an exception: the billing record a4, already 45 days old, is retained by every gate while the hold is on.
What the opening run removes
On day 3 the subject request removes a1 and a2 and reports one held record retained, a4. The day 9 sweep removes b2, 59 days old by then, and again retains a4. The day 20 sweep removes a3 and b1, now 23 and 26 days old, while late-1, written on day 12, is too young. Primary storage ends with only a4 and late-1. Set the window to 30 days and the day 20 sweep removes nothing; set it to 10 and the day 9 sweep already removes a3, b1 and b2.
Remove the hold
Clear Hold billing records against deletion. The day 3 request now removes a1, a2 and a4, three records, and the day 17 backup purge removes all three from the backup. With the 20-day window primary storage ends with late-1 only. A hold is a deliberate exception to both the request and the retention policy; the trace states each time it applied.
Gates on primary storage are not the whole story
Even with the opening settings, the backup still holds a3, b1 and b2 at day 20 because only requested deletions schedule a backup purge, and the export from day 2 still contains a1, a2 and a4. Clear Block restoration of deleted IDs: the day 10 restore brings a1, a2 and b2 back into primary storage and day 11 flags three revived records. The day 20 sweep then removes five records, the three revived copies plus a3 and b1, which hides the failure rather than fixing it.
Reading the replay and its limits
Play, Pause, Next event, Restart, Speed and the Inspection slider replay ten scheduled days across sixty seconds; every edit recomputes and rewinds. Requested tenant, Actor tenant, Requested subject and Identity verified by the fixture gate the day 2 export and day 3 deletion: an Actor tenant of Beta or a cleared Identity verified by the fixture denies both, Subject s2 moves the request to a3, and Request scope Whole tenant / offboarding exports a1 to a4. Personalization purpose consent changes only the day 1 use decision, Minimize export fields decides whether exported copies keep tenant, subject and age, and Backup purge after deletion (days) sets the backup purge, day 17 at the opening 14 days. Holds here are a single fixture switch for billing records, not a legal hold process with owners, scope and release; retention runs on two fixed days. Records and policies are fictional, and the run is not legal advice.