How can a year of audit-selection decisions stay reviewable without the log retaining the filers' identities?

## Split the record A decision log for audit selection has to serve two very different readers. An oversight review wants a year of decisions in aggregate. A challenge wants one decision, attributed to one person. Building one record that serves both means retaining identity on every row for years, which is the outcome you are trying to avoid. The split is straightforward once stated: | part | contents | retention | who reads it | |---|---|---|---| | decision record | id, timestamp, tokenised subject, input snapshot, versions, score, threshold, action | the long window — as long as a selection can be challenged | reviewers, analysts, the append-only verifier | | identity mapping | token to filer identity | the shorter window, and revocable per subject | a narrow role, per case, with the lookup itself logged | The decision rows stay append-only and chained; the mapping is an ordinary, tightly-controlled store that can be written to and deleted from. That asymmetry is deliberate and it is what makes the rest work. ## Most review questions need no identity It is worth checking how much of the review load actually requires a name. "Was the cut applied consistently across the near-threshold band?" needs score, threshold and action. "Did selections concentrate in one filing type or one income band?" needs banded features. "Which model version made these decisions?" needs the version stamp. None of them needs to know who the filer was. Identity is needed for exactly one workflow — someone challenges their own selection — and that is a single-record lookup, authorised per case, through the mapping. Designing for the bulk case first is what lets the identity store stay small and tightly held. ## Pseudonymisation is not anonymisation The common mistake is to call the tokenised record anonymous and relax its controls. It is not anonymous, for two reasons. 1. **The mapping exists.** A pseudonym is a reversible reference by construction. While the mapping is retained, the row is attributable to a person by anyone who can reach both. 2. **The retained figures identify.** Income, sector, region and filing type are quasi-identifiers. A sufficiently unusual combination singles out one filer even with no token at all — and a tax return is full of unusual combinations. So the decision record keeps its access controls and its retention limit. Where an extract leaves for an external review, coarsen the quasi-identifiers — band the income, widen the region — and state the criterion you are releasing under, such as a minimum group size of *k* under k-anonymity, rather than asserting that the extract "has no names in it". ## Choosing the window The retention meant here is how long a **decision record** is kept, which is not the same question as how long a model artifact stays rebuildable; the two are routinely confused because both are called retention. Retention is set from the obligation, not from "storage is cheap". The decision record's window is the longest period in which a selection can be challenged or reviewed, plus a margin. Then it expires, and expiry is enforced by the store rather than by a job someone can disable. Keep that clock separate from the one that governs how long a model artifact stays rebuildable. They answer different questions and are usually different lengths; tying them together over-retains one or truncates the other, and the conversation about each becomes impossible to have on its own terms. ## Erasure against an append-only log The two requirements look contradictory: the decision rows must not be deleted or edited, and a person may be entitled to have their data removed. They are reconciled by deleting the **mapping entry**, not the rows. - The rows survive, with their hashes intact and the chain verifiable. - Nothing in them attributes a decision to a named person any more; the token dangles. - The aggregate record of what the system decided that year remains complete, which is what the oversight review needs. This is the main structural argument for the split, more than access control is. An append-only log that contains identity has no answer to an erasure request except to break itself. One that references identity indirectly has a clean one. The residual issue is the quasi-identifiers in the retained figures, which is why the coarsening rule above applies to anything that leaves the controlled store.