Logs must be kept until accountability might arise, not only as long as debugging needs them

What it is

Debug logs live on a troubleshooting clock: days, a few weeks at most. Accountability’s clock follows complaint, audit, litigation: months to years. Retain logs for accountability not debug requires the triple’s life to follow the second clock. Cleared when the troubleshooting window closes, traceability is empty on the day it is needed.

A disk policy written “save cost” reads, on the day of accountability, as “no evidence was left.”

Why it happens

Debug cares about reproducing the bug in front of you; fields may be incomplete, life may be short. Accountability cares about that one time: input, basis, external result, often asked much later. Products that mix the two kinds of log in one pipe will cut on debug’s short life. Permission ledgers, release snapshots, external checks, once cut, do not help however complete the fields were. Retention is not infinite: there is a stop, and the stop is set by “the latest this class of act might be asked about,” not by a log system’s default seven days.

Privacy and minimisation collide with long keep. The collision is resolved by act grade: the triple for outward-irreversible is kept long, reversible-inward short, not one short cut for all.

Studying it

Simulate “event → investigation after interval D.” Compare retention shorter than D, equal to D, longer than D. Dependent variables: whether the triple is still there, whether the investigation can finish, whether only human memory remains. Independent variables: D as complaint cycle, audit cycle, legal floor; whether accountability logs and debug logs are separate pipes.

An investigation that fails because “logs expired” is life set to the wrong clock.

Where it stops holding

If the fields are incomplete, keeping them longer still cannot replay. If the person did not know which rung they were on, logs will not restore that awareness; they can only record which rung was displayed. When systems are chained, if each segment’s life disagrees, the chain breaks at the shortest. Infinite keep collides with a right to delete; a defensible term per grade is required, not a quiet short cut.

Applying it

• Split the accountability triple out of the debug pipe, and write life by act grade into policy: outward-irreversible to your complaint/audit ceiling; reversible-inward may be short.
• Expiry deletion should leave a meta-record “there was one, deleted on date by policy,” so investigators do not think it was never written.
• Check: wind the clock past the complaint cycle, look up one outward act. If the triple is gone, life is still on debug. Split the pipes, wind again — if it is still there, the clock matches. Then look up an inward tag, and confirm it was not wrongly kept to the outward ceiling.

Related

• Same group: L4.15.1 Degree of automation allocates responsibility, but users usually do not know which tier they are on · L4.15.2 Traceability requires recording input, decision basis, and result together; missing one makes replay impossible · L4.15.4 Handing final confirmation to a person does not mean responsibility has been fairly transferred; the person must have the conditions to refuse · L4.15.5 When systems are chained, the responsibility chain breaks at the interfaces; each segment's boundary must be drawn in advance
• Nearby: L4.06 Permission Boundaries of Agents · L1.11 Reproducibility of Non-deterministic Output · L4.11 Pre-action Confirmation and Irreversible Operations
• Search terms: log retention · accountability · audit trail