CodamAIDocs
Topicdone

An inspection report over the years

Ben creates a final inspection report, Anna verifies it later, a dispute freezes it. What happens to the document when Ben leaves and when the customer cancels.

Variants
create a final report, second versionverify the documentset and release a legal holdthe person leavesthe tenant is suspended or closedretention endserasure at the person's request

What this is about

Ben works for the customer nordbau and has finished the audit audit-4711. From the data in CDMS he creates the final inspection report. From then on the document no longer belongs to Ben but to the tenant nordbau, and it has to stay unchanged for ten years.

This page follows the document through those ten years: Anna verifies it, a dispute freezes it, Ben leaves the company, and in the end nordbau cancels.

The people involved

WhoWhat they haveWhat that allows in CRMS
Benan account in nordbau, no CRMS rolerendering, with every template he can see. That needs no role
Annaadministrator of nordbau, plus crms-document-reader and crms-document-custodianlisting, reading and verifying documents, setting and releasing a legal hold
the installationdocument revisions on, CODAMAI_CRMS_DOCUMENT_RETENTION=P10Yevery final document is kept for ten years

The role names are the defaults; they are set on the CRMS module in the hub, see The roles. In this case nobody has a role for erasing.

The timeline

gantt
    dateFormat YYYY-MM-DD
    axisFormat %Y
    section Document
    retained (retainUntil)            :active, 2026-10-17, 2036-10-17
    section Legal hold
    dispute with the client           :crit, 2027-03-01, 2029-06-30
    section Ben
    works at nordbau                  :done, 2026-01-01, 2027-09-30
    section nordbau
    customer                          :done, 2026-01-01, 2029-12-31
    no longer served                  :crit, 2029-12-31, 2036-12-31

1. Ben creates the report

From the finished audit to the record
  1. 1
    User→Application
    Ben clicks "Preview". The application reads the audit from CDMS and calls CRMS with PREVIEW
    The PDF visibly carries PREVIEW and is stored nowhere.
  2. 2
    User→Application
    Ben clicks "Finish". The same call, now with FINAL and the reference audit-4711
  3. 3
    CRMS→CIAS
    asks who is calling: Ben's user ID, tenant nordbau
  4. 4
    CRMS
    finds the tenant's edition of audit-report (scope TENANT), checks the payload, renders, seals
  5. 5
    CRMS→File storage
    stores the encrypted bytes, locked until 17 Oct 2036
  6. 6
    CRMS→Database
    writes revision 1 of the chain into the database of nordbau, with Ben's user ID, time and hashes
    Result: Ben gets the PDF; the answer names the revision in the header Crms-Document-Revision.

The path station by station is on From the click to the report.

A week later Ben notices a typo in an answer. He corrects it in CDMS and finishes again. The same template and the same reference give revision 2 of the same chain. Revision 1 stays next to it, unchanged and with its own retention. A final document is never overwritten, see What a final document is.

2. Anna verifies the report

In spring the client asks whether the report was changed afterwards. Anna has CRMS check:

Anna's calls
GET /crms/documents?template=audit-report&scope=TENANT&reference=audit-4711
→ both revisions, oldest first, each with contentHash and storedAt

POST /crms/documents/<revision 2>/verify
Result of the check
{ "ok": true }

ok: true means: every entry of the chain matches its hash, and the bytes match the content hash. That proves the document is unchanged since it was stored. It does not prove that Ben’s answers in the audit were correct. If the client only has a copy of the PDF, they compare its SHA-256 with Crms-Document-Content-Hash or check the seal. See Verify and read.

Anna only sees documents of nordbau. The tenant comes from her token, and a revision of another tenant does not exist for her: 404 document-not-found.

3. A dispute freezes the document

The client goes to court. Until the dispute is decided, nothing of the audit may disappear, not even after the retention ends.

Setting a legal hold
  1. 1
    Admin→CRMS
    Anna sends POST /crms/documents/<revision 1>/legal-hold with {"reason": "litigation-hold"}
  2. 2
    CRMS
    Does Anna hold one of the hold roles? Otherwise 403 document-access-denied, before CRMS even looks for the document
  3. 3
    CRMS→File storage
    sets an S3 legal hold on every object of the chain
  4. 4
    CRMS→Database
    appends LEGAL_HOLD_SET with Anna's user ID and the reason to the chain
    Result: 204. The hold applies to the whole chain: revision 1, revision 2 and every one added later.

The reason is a key, not a sentence, because it stays in the chain forever. When the dispute ends in June 2029, Anna releases the hold with POST …/legal-hold/release and {"reason": "litigation-ended"}. After that, each revision’s own retention dates apply again. More on Retention, legal hold and erasure.

4. Ben leaves the company

On 30 September 2027 Ben leaves. Anna revokes his roles, a platform administrator suspends and later closes his account, as on A person leaves the company. In CRMS this changes nothing about the documents:

After Ben has left
Stays
unchanged
  • both revisions of the inspection report, with Ben's user ID as the person who created them
  • the legal hold Anna set
  • the entries in the journal of nordbau
  • Ben's personal templates (scope USER) in the database of nordbau
Goes
only Ben's access
  • Ben renders nothing once his last token has expired
  • Ben's personal templates render for nobody: resolution only looks at the editions of the person who asks

Anna and everyone else with the reader role in nordbau keep reading and verifying the report. For CRMS, Ben is just an ID in the chain. It does not ask whether his account still exists.

5. nordbau cancels

nordbau is no longer served from 1 January 2030 and is closed later, as on A customer cancels. Afterwards two things run separately:

What happens to the documents after the cancellation

When: Someone wants to read, verify, hold or erase a document of nordbau.

Each of these requests names the tenant nordbau, and the tenant gate refuses it before CRMS sees it. That applies to Anna, to every other person of the customer and also to platform support: nobody can switch into a suspended or closed tenant. If CRMS runs as a separate service, the same gate stands there.

Result: 403 cias.authentication.tenant-not-served. Nobody reads, verifies, sets or releases a legal hold.

When: Anchoring the journals and the retention pass, without a request.

These passes get the list of all tenants from CIAS, served or not. The gate admits suspended and closed tenants for this obligation work, because their journals still have to be anchored and their retention still ends. The retention pass erases every due revision as user crms-retention with the reason retention-expired. A revision under a legal hold stays on the list and comes up again in the next pass.

Result: On 17 Oct 2036 bytes and document key are deleted; the revision stays in the chain as a tombstone.

That is why Anna released the legal hold herself in summer 2029. After the cancellation nobody can release it through the API any more. A hold that still applies then keeps the document beyond the end of its retention.

What else stays: the database in which CRMS keeps the documents of nordbau, with all entries and tombstones. Embedded, that is the tenant’s database in the application; with the separate service, the tenant’s database in the CRMS service. CDMS never deletes a database, and CRMS only appends. So the chain stays verifiable even after erasure, as soon as someone may look in again.

Who can still read when

Can Anna read the inspection report?
Tenant nordbau is servedAnna has the reader roleRevision still has bytesAnswer
no––403 cias.authentication.tenant-not-served, from the filter chain
yesno–403 document-access-denied, without revealing whether the document exists
yesyesno410 document-erased. The check still reports ok: true as long as the chain is intact
yesyesyes200 with the bytes, checked against the content hash

What the chain and the journal record

EventEntryPerson
Ben finishesrevision 1, document-storedBen’s user ID
Ben finishes againrevision 2, document-storedBen’s user ID
Anna reads the documentdocument-read, only with CODAMAI_CRMS_AUDIT_READS=trueAnna’s user ID
Anna sets the holdLEGAL_HOLD_SET, document-legal-hold-set, reason litigation-holdAnna’s user ID
Anna releases itLEGAL_HOLD_RELEASED, document-legal-hold-released, reason litigation-endedAnna’s user ID
retention endsERASED, document-erased, document-key-destroyed, reason retention-expiredcrms-retention

The check through verify does not count as reading.

Traps

Next

Search