Backup and Restore Service  ·  View 25 of 26  ·  7 · Assurance

Shortening a Retention Lock — Two People, No Standing Credential

How a lock is shortened or a legal hold released, when no single person and no single component is allowed to do it.

Editable source SVG draw.io All views
Requester Retention broker Officer 1 Officer 2 Break-glass OpenBao Custody RGW Evidence store 1. shorten set S · legal basis 2. intent · object list hash 3. review request 4. unseal share 1 5. unseal share 2 · not requester 6. 15-min credential scoped to S 7. PutObjectRetention · bypass 8. updated versions 9. seal 10. done · both approvers Shortening a Retention Lock — Two People, No Standing Credential Extending a lock or placing a hold needs no unseal. Only reductions and hold release do. v 1.0 · owner Custody · date 2026-09

Decisions

  • The permission to bypass retention lives only in a dedicated OpenBao instance in the custody domain, which is sealed at rest. Unsealing needs 2 of 5 Shamir key shares held by custody officers, so the two-person rule is enforced by cryptography, not by a workflow flag.
  • The broker coordinates, records and scopes, but holds no standing right. Once unsealed, the instance issues one 15-minute credential limited to the listed object versions, and the broker seals it again as soon as the call returns.
  • Governance-mode locks are used for tier retention so that lawful disposal remains possible. Compliance mode is used for the evidence store, which no request can shorten at all.

Numbers

  • Expected volume: a few requests a quarter, mostly lawful erasure and correcting a wrong tier. Each takes about an hour of officer time, which is a deliberate cost.

Risks

  • Losing three of five share holders at once makes reductions impossible until shares are re-issued. That is the safe way to fail, and share holders are reviewed at every leaver or role change.
◀  Security — Trust Zones All views Failure Modes — Detection, Containment, What Keeps the Copies Safe  ▶
Solution Architecture v1.0 · Platform Architecture · 2026-09 · 26 views · open source, fully on-premises25-retention-reduction-dual-control