Skip to main content
Customer guide

Investigation and decisions

Follow an authorized event through review, hold and escalation without inventing missing content.

For: Security investigator, Reviewer, Incident owner

Before you begin

Use a named authorized investigator and an agreed synthetic event. Confirm who may view decision metadata, make a hold decision and receive an escalation under your organization’s policy.

  1. Record the time window and governed surface.
  2. Avoid putting original prompt content into a ticket or support message.

Supported scope and current status

The public evidence description covers linked decision metadata from governed paths. It does not promise that every off-path action was recorded or that raw original content is held; access to any separate employee activity content has distinct controls.

  1. Check /platform/evidence for the record type.
  2. Use /privacy for the content and retention distinction.

Compare this path with the published coverage table and the coverage guide.

Set up the path

Have the workspace owner authorize the reviewer role and the applicable routing and escalation policy. Identify the source event before opening a hold or case; a route assignment alone grants no permission to read restricted content.

  1. Confirm the reviewer’s current role.
  2. Set the case population and decision owner.

Use the workflow

Find the event in the scoped time window, inspect its decision and correlation, then record a deliberate disposition using the offered controls. Use a separate approval when the action requires it.

  1. Preserve the original event reference and policy revision.
  2. Record each handoff or hold decision as its own action.

Verify the result

Read back the persisted disposition, current assignee and ordered event history. Where an audit verifier is available, test the chain independently and note any uncovered tail.

  1. Compare case detail with the original decision metadata.
  2. Confirm a changed or withdrawn authority does not leave cached restricted detail visible.

Coverage references: 21 requirements, 0 currently passed

This guide is bound to 21 requirements in RedactWall's acceptance crosswalk, which is maintained internally and not published. A requirement counts as passed here only after current evidence for every bound scenario and authority has been published; none has been published yet.

See the public verification overview and the documentation coverage guide.

Denials and recovery

A stale case revision, missing role or uncertain commit must not be bypassed by a second untracked decision. Refresh the case and use the supported retry only for the same intended action.

  1. Read current state before resubmitting.
  2. Escalate an unreadable record or uncovered evidence period as a gap.

For customer-side next steps, read Recovery and support.

Billing and integration handoffs

Incident review may depend on a configured source and a chosen content-free alert destination. Those systems have their own customer administrator and recipient permissions; no ticket or SIEM destination is implied by this guide.

  1. Check the selected integration owner.
  2. Confirm the current plan and evidence access roles.

Limits to keep in view

A quiet search is not proof of no incident, and a valid chain does not prove every event was captured. Full-original custody and automatic legal reporting are not established by the current public site.

  1. State the exact population and unreadable gaps.
  2. Do not send raw content to a new destination for convenience.

Review the current Disclosures before relying on a capability.