Evidence-Age Release Rule¶
Decision rule — instantiates Capture-Latency Evidence Stratification
Gates whether aging evidence may be released for a decision by testing it against an age threshold and attaching the warning the age warrants.
An Evidence-Age Release Rule is a small, sharp piece of policy that sits at the boundary between the evidence store and the decision that wants to use it, and answers one question: given how old this is, may it be acted on, and with what caveat? Its defining move is that it converts the passage of time into an explicit gate. Below a chosen age, evidence passes clean; past a threshold it is downgraded, must be refreshed or corroborated, or is stamped with a warning that travels with it downstream; past a harder threshold it is blocked from authoritative use altogether. The rule does not measure age or display it — it decides on it. That decisiveness is the whole mechanism: it turns "this feels stale" into a repeatable release verdict nobody has to re-argue case by case.
Example¶
A security team runs a blocklist fed by threat-intelligence indicators — IP addresses and domains flagged as malicious. An indicator observed attacking a partner two hours ago is strong evidence; the same indicator, last seen ninety days ago, is probably a recycled, now-innocent address, and blocking on it risks cutting off a legitimate service.
The release rule encodes this as tiers: an indicator under 7 days old may auto-block; 7–30 days old may only alert, not block, and any alert it raises carries the label "aged indicator, confirm before acting"; over 30 days old it is retired from active enforcement and moved to reference-only. When an analyst pulls a 45-day-old indicator into a takedown request, the gate refuses to release it as actionable and returns the reason. The point is not that old indicators are worthless — they inform investigation — but that the authority the evidence carries into a decision is bounded by its age, automatically and consistently, so no single tired analyst has to make that judgment fresh at 3 a.m.
How it works¶
- Define the clock. Fix which timestamp "age" is measured from — event time, capture time, or last-corroboration time — because the answer changes the verdict.
- Set tiered thresholds. One or more age cutoffs, each mapped to a release action: pass, downgrade, require-refresh, warn-only, or block.
- Gate at the boundary. Every request to use the evidence for a decision runs through the rule; the rule returns a verdict and, critically, a reason the requester can see.
- Attach the warning. When aged evidence is released in a limited form, the rule stamps the caveat onto the released artifact so the downstream decision inherits it rather than seeing a clean number.
Tuning parameters¶
- Threshold values — where the age cutoffs sit. Tighter cutoffs reduce the risk of acting on stale evidence but increase false blocks and refresh workload; looser cutoffs do the reverse.
- Reference timestamp — event vs. capture vs. last-corroboration age. Corroboration-based aging keeps re-verified evidence alive longer but costs verification effort.
- Action per tier — how severe the response is (soft warning through hard block). More blocking is safer and more brittle.
- Override policy — whether a human can release aged evidence anyway, and what they must log to do it. Overrides add flexibility but reopen the judgment the rule was meant to standardize.
When it helps, and when it misleads¶
Its strength is consistency: it makes staleness a first-class, automatic property of release rather than a gut call, and it guarantees that when old evidence is used, the decision sees the caveat. It is the mechanism analogue of a time-to-live: evidence, like a cached record, has a horizon past which it should not be trusted without refresh.[n1]
Its failure mode is that age is a crude proxy for reliability. Some evidence ages in minutes (a live metric); some is valid for years (a birth date). A single global threshold will both block good old evidence and pass bad fresh evidence, and a badly chosen clock (aging from capture when event-age is what matters) can be confidently wrong. The classic misuse is treating the rule's "pass" as a certification of truth rather than of acceptable age — a two-day-old indicator can still be wrong. The guarding discipline is to tier thresholds by evidence type, tie aging to the timestamp that actually governs decay, and keep the rule's verdict scoped to "old enough to distrust," never inflated to "verified."
How it implements the components¶
evidence_age_threshold— the rule is the threshold: the codified age cutoffs that separate actionable from aged evidence.reconciliation_and_release_gate— it is the gate that decides whether, and in what downgraded form, evidence may be combined into an authoritative decision.downstream_decision_warning— when it releases aged evidence, it stamps the caveat that rides into the decision so the warning is not lost.
It does not implement capture_latency_window or silence_or_absence_register — measuring and displaying latency and missing streams is Evidence-Latency Dashboard, its nearest twin; the dashboard shows the age, while this rule acts on it and blocks release.
Related¶
- Instantiates: Capture-Latency Evidence Stratification — the release-gate machinery that keeps aged evidence from entering decisions unqualified.
- Consumes: Evidence-Latency Dashboard — the measured ages the rule tests against its thresholds.
- Sibling mechanisms: Evidence-Latency Dashboard · Provenance and Chain-of-Custody Log · Read-Only Raw Evidence Archive · Reconstruction Workspace or Replay Table
Editorial Notes¶
Form Classification¶
Form family: Rule, Policy & Commitment
Rationale: Evidence-Age Release Rule operates as a standing rule, threshold, contractual commitment, or policy constraint governing future conduct because it gates whether aging evidence may be released for a decision by testing it against an age threshold and attaching the warning the age warrants.
Independent corroboration: The frozen evidence defines Evidence-Age Release Rule as 'Gates whether aging evidence may be released for a decision by testing it against an age threshold and attaching the warning the age warrants', so its operative form is Rule, Policy & Commitment.
Nearest alternative: Decision, Gate & Allocation — The rule returns a case-specific release verdict, but its tiered age thresholds and warning obligations are standing constraints on every use request.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Library & Information Science
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Records and information-governance traditions formalized currency, retention, supersession, and controlled release of evidence.
Related originating lineages:
- Computer Science & Software Engineering — Cache expiry, time-to-live, and freshness-gated data use materially shape the rule's tiered age logic.
- Law & Governance — Legal evidentiary practice materially contributes admissibility gates and warnings attached to stale material.
Review resolution: Both reviewers agree that library_information_science is primary. I retain law_governance, computer_science only as formative origin lineages; cross_disciplinary_synthesis is appropriate because the final form materially combines the agreed primary with the retained formative lineages. Reach is multi_domain because the structure transfers across several fields but is not a near-universal human pattern, an applicability judgment kept separate from provenance. Encyclopedia synthesis is true because the exact generalized artifact is an encyclopedia-authored combination or refinement. The reviewers' stated ambiguity is retained verbatim in the final record.
Attribution caveat: No single canonical tradition appears to own this exact age-gated release rule. The exact name appears synthesized from records-governance and computing freshness controls rather than inherited from one profession.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; medium confidence.
Notes¶
[n1] Time to Live (TTL) is the standard networking and caching mechanism that stamps data with an expiry after which it must be discarded or refreshed rather than trusted — the direct technical analogue of gating evidence use on age. ↩