File Upload & Scanning Pipeline · View 06 of 21 · People and journeys
What the journey proves
- Indeterminate must be its own verdict and its own state: collapsing "we found something" with "we could not finish looking" makes every block unarguable and every appeal a guess
- Release requires a named role, a recorded reason and an immutable transition — and an object with a current infected verdict cannot be released through this path at all
- The admin decides without ever obtaining the bytes; reading the sample is a different authority, exercised by a different person, through an audited break-glass path
Where it hurts
- The admin's instinct is to open the file to be sure, which is precisely the action the architecture exists to prevent
- A false positive costs a finance team its quarter-end model, so the ≤ 0.01% budget and the 4-business-hour appeal are product requirements, not security ones
- Evidence retention and the member's expectation of deletion are in genuine tension; the platform keeps the minimum and says so
Stated assumptions
- False-positive budget ≤ 0.01% of clean objects; indeterminate ≤ 0.2%
- Evidence retained 180 days, then irreversibly destroyed
- Appeal resolved within 4 business hours
