Audit Log Service  ·  View 26 of 40  ·  5 · Runtime

Legal Hold

How disposal is suspended indefinitely without anybody touching, moving or hiding a record.

Editable source SVG draw.io All views
Matter Litigation Notice counsel Regulator Request supervisory Scope Scope Declared tenant · actor · resource Time Range open-ended permitted Two-Person Approval legal + compliance Apply Hold Registry legal role writes retention_until Extended extend only Disposal Suspended indefinitely Effect Segments Excluded from every sweep Tiering Continues cost still falls Index Unaffected queries unchanged Lift Matter Closed same two roles Expiry Recomputed never backdated Evidence Hold Is a Record placed and lifted Certificate Cites It why it waited audited Legal Hold — Suspending Disposal Without Touching a Record External / third party Application we own Decision point Data store Security / platform Opportunity event / async A hold changes when a record may be disposed of and nothing else. It does not hide the record, does not move it, does not alter its class and cannot be applied by anyone who can read the records it protects. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • A hold changes when a record may be disposed of and nothing else. It does not hide the record, does not move it, does not change its class and does not affect what a query returns.
  • Holds are placed at tenant, actor, resource or time-range granularity by a segregated legal role that holds no read capability over the records it protects — and no role that can read records can place a hold.
  • Tiering continues under hold. A held segment still moves to cool and archive storage, so an indefinite hold does not become an indefinite hot-storage bill.

Evidence

  • Placing and lifting a hold are both audit records with their own approvals attached.
  • The disposal certificate for a surrounding range cites the hold that delayed part of it, so a gap in disposal has an explanation inside the log rather than in someone's inbox.
  • Lifting a hold recomputes expiry forwards; it is never backdated, so nothing becomes retrospectively disposable.

Assumptions

  • Actor- and resource-granularity holds are phase 2; tenant and time-range granularity ship in the MVP. A phase-1 hold on a broad range is over-inclusive, which costs storage and is the correct direction to err.
◀  Disposal All views When the Audit Plane Is Unavailable  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source26-legal-hold