Disposition
What this page is — the queue of documents whose retention has elapsed, grouped by record series, and the three actions that close them out: destroy, keep permanently, or record a review.
What it is for — so the end of a record's life is a reviewed, audited decision with a certificate, not a deletion somebody performed.
The problem it solves — expired records are either kept indefinitely or deleted informally, with no evidence of who decided.
Route: /org/papers/records → Disposition · Permission: Manage record series/file plans, apply/release legal holds, execute disposition and stamp vital reviews. to act;
View file plans, record series, retention status, legal holds, disposition and vital-review queues. to see the queue.
1. What it is
A document appears here only when all three hold:
| Condition | Why |
|---|---|
| It has a keep-until date, and that date has passed | Retention has elapsed |
| It is not already disposed | — |
| No active legal hold covers it | Held documents are excluded entirely, not greyed out |
Documents are grouped by record series, each group badged with the series' scheduled action. Documents with an elapsed retention date but no series land in Unclassified documents.
Nothing here happens automatically. A person always executes.
| Button | Effect | Leaves the queue |
|---|---|---|
| Destroy | State becomes disposed, the document's field values are purged, a destruction certificate is produced | Yes |
| Keep permanently | Retention date cleared; recorded with the date it used to have | Yes |
| Mark reviewed | Stamps a review and records it | No — it stays until destroyed, kept, or its retention is extended |
The scheduled action badge is guidance, not a constraint: the buttons act on whatever you select.
Destroy clears the document's field values and sets it to disposed. It does not remove:
- the version history — each version keeps a snapshot of the field values and the rendered text;
- sealed PDFs and attachments;
- the document's passages in the semantic search index, which Ask the repository can still quote;
- saved AI results such as summaries and extracted terms.
The destruction certificate therefore certifies less than it appears to. Treat Destroy as a partial purge, and do not present its certificates as proof that a record no longer exists.
2. Why you would use it
- Destruction becomes demonstrably routine. The value of a disposition programme is showing that destruction was scheduled and authorised, not convenient.
- Every destroy produces a record. A certificate per document with a SHA-256 hash of its field values at the moment of destruction — see the warning above on what that does and does not cover.
- Deferral is defensible. Mark reviewed is audit evidence that a person looked and chose to wait.
- Late holds are still honoured. Destroy re-checks holds and retention per document at execution time.
3. Step by step
- Open Disposition. Read each group's scheduled action and each row's due badge.
- Open anything you are unsure about — every row links to its workspace.
- Tick documents, or a group header to select the whole group.
- Press Destroy, Keep permanently or Mark reviewed, and confirm.
- Read the Last run panel.
- After a destroy, Download destruction certificates immediately and file the JSON with your compliance records.
The document's field values are purged and its state set to disposed; title, number and audit timeline remain. Versions, sealed PDFs, attachments and the search index are not purged. When in doubt, Mark reviewed instead.
4. Field reference
Refusals, per document
| Message | Cause |
|---|---|
| document is under an active legal hold; disposition is blocked | A hold was applied after the page loaded |
| retention period has not elapsed; destroy refused | The keep-until date is still in the future |
| document is already disposed | Someone else destroyed it first |
| at most 100 documents per disposition request | Split the selection |
| invalid action: use destroy, permanent or review | — |
Failures are per document: one refusal never rolls back the others.
Destruction certificate (JSON)
| Field | Holds |
|---|---|
| Document id, number, title | What was destroyed |
| Series and action | Under which rule |
| Content hash | SHA-256 of the document's field values at destruction — not of versions, PDFs or attachments |
| Executed by, at | Who and when |
The certificate is JSON, not PDF, in this version. The Last run panel holds only the most recent run in this browser session — the same facts stay on each document's audit timeline.
Audit events
| Action | Event on the document |
|---|---|
| Destroy | disposed |
| Keep permanently | marked_permanent, with the previous retention date |
| Mark reviewed | disposition_reviewed |
Transfer
Series can schedule Transfer, and groups show it, but there is no Transfer button — no archive integration exists. Export what you need by hand, then Mark reviewed to record the handling.
5. Worked example
A records manager runs the quarterly disposition review.
Finance — invoices (Destroy), 40 documents. They tick the group header and press Destroy. Last run: 39 processed, 1 failed — the failure reads document is under an active legal hold; disposition is blocked: counsel had placed a Northwind hold that morning. They download the certificates JSON and upload it to the compliance archive.
Legal — contracts (Review before action), 6 documents. Legal asks to keep everything until a merger closes. They select all six and Mark reviewed. The documents stay in the queue; the review event is the audit proof.
Unclassified documents, 1. The 2019 founding shareholders' agreement surfaced through a manual retention date. They press Keep permanently; it leaves the queue for good, with its old date recorded.
6. The admin contract
| Must be true | Where | What breaks without it |
|---|---|---|
| The role holds Manage record series/file plans, apply/release legal holds, execute disposition and stamp vital reviews. | Role editor | Checkboxes and buttons do not render |
| Documents are classified with keep-until dates | File Plan | The queue is always empty |
| Holds are applied before disposition runs | Retention & Holds | Documents that should be preserved are destroyable |
| Certificates are archived after each destroy run | Your process | Only the per-document audit trail remains |
| Someone handles Transfer-scheduled groups by hand | Your process | They sit in the queue indefinitely |
7. Downstream
| After… | Then |
|---|---|
| Destroy | State disposed; field values purged; certificate produced; leaves every queue. Versions, PDFs, attachments and index entries remain |
| Keep permanently | No retention date; never returns to the queue |
| Mark reviewed | Stays in the queue; the review stamp also counts as a vital review for vital series |
8. Don't confuse this with…
| Revoking | Withdraws a document from use; it still exists |
| Archiving | A lifecycle state; nothing is destroyed |
| Data & Privacy erasure | Anonymises one person's data on request |
| Deleting a draft | Not available for documents |
9. Troubleshooting
| Symptom | Cause |
|---|---|
| The queue is empty | Nothing has elapsed, or everything elapsed is on hold |
| An expected document is missing | It is on hold, already disposed, or has no keep-until date |
| Mark reviewed did not clear anything | By design — it records a deferral |
| The certificates button disappeared | It holds only the last run in this session |
| No Transfer button | Transfer cannot be executed yet |
| One document in a batch failed | A hold or retention change since the page loaded |
| A destroyed document's PDF, versions or Q&A citations still appear | Destroy clears only field values |