Record Retention and Audit Evidence

Governance evidence is not one artifact. It is a trail of decisions, refusals and approvals spread across months of traffic. Teams reach for this starter when they need that trail to exist by default rather than by heroics. The trap is assuming that collection and retention are the same setting.

The name of this starter carries its own warning. Gathering evidence and keeping evidence are separate jobs, and only the first one happens in the request path. Audit marking flags a request that was evaluated. It builds no archive, sets no schedule and makes nothing permanent. The period you must observe lives in platform settings that your team configures.

Evidence is only useful when it is clean. Masking strips national identifier patterns out of the material you gather, so a governance file does not turn into a privacy incident. The credential block list keeps a pasted key out of the same file. Output scoring holds a drafted summary to a combined 0.85 before it is returned.

Agree with your auditor which events matter and how long you must hold them. The review step arrives as an empty block, so treat it as an approval gate that is available rather than active. Grounding checks flag a thin source and still return the text, which is the right default while you are collecting rather than deciding.