Legal holds
The Legal holds screen lets you place a hold that suspends the purges of the evidence for a case, and release it:
the release needs two distinct approvers. Portal path: /audit/legal-holds. It is used by the auditors (auditor),
the security officers (security_officer) and the tenant administrators (tenant_admin).
What the screen shows
At the top, the release rule: "The first release approval is recorded; the hold is released at the second distinct approver."
A Holds table with Refresh and New hold:
| Column | Content |
|---|---|
| Case | Identifier of the case. |
| Reason | Reason of the hold. |
| From | Start of the period held. |
| To | End of the period held. |
| Status | active, or the state after release. |
| Created by | Author of the hold. |
| Approvers | Approvers of the release already recorded. |
| Released at | Date of the release. |
A click on a line shows it in a side panel. The list is read in one call. Empty state: No legal hold, "Place a hold to suspend purges for a case."
Actions
| Button or action | What it does | API call | Roles |
|---|---|---|---|
| Opening the screen, Refresh | Reads the holds and their release approvals. | GET /v1/evidence/holds | auditor, security_officer, tenant_admin |
| New hold then Create | Form Case (required), Reason (required), From, To (dates and times). The purges of the period stop for this case. | POST /v1/evidence/holds | auditor, security_officer, tenant_admin |
Approve release (status active) | Dialog Reason (required). The first approval is recorded in Approvers; the second approval by another person releases the hold. | POST /v1/evidence/holds/{id}/release | auditor, security_officer, tenant_admin |
| Click on a line | Shows the line in a side panel. | none | Same roles |
Roles
From services/control-plane/src/eai/domains/evidence/common.py: every hold route requires HOLD_ROLES (auditor,
security_officer, tenant_admin); platform_admin passes the check. The portal hides New hold and Approve
release for the roles outside ROLES.holdWriters of portal/src/lib/kit.ts. The same person cannot give both
release approvals.
Once released, the hold no longer protects the payloads of the case: the next retention run may purge them. Release a hold only when the case is closed.
Typical tasks
Hold the evidence of a case
- Create the hold. Button New hold: Case
CASE-2026-014, Reason, From and To of the period concerned, then Create. Expected result: a line with the statusactive. If it fails:forbiddenwhen your role is not a hold role. - Check the retention. Open Evidence and seals, tab Evidence retention. Expected result: the payloads of the case are listed as held. If it fails: check that the period of the hold covers the events.
Release a hold with two approvers
- First approval. Row menu > Approve release, Reason, submit. Expected result: your identity appears in
Approvers, the status stays
active. If it fails:audit_hold_not_active(HTTP 409) when the hold is already released. - Second approval by another person. Another user with a hold role runs Approve release. Expected result: the
status changes and Released at is filled. If it fails:
audit_hold_same_approver(HTTP 409) when the same person approves twice.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
audit_hold_same_approver (HTTP 409) | The second approval comes from the first approver. | Ask another auditor, security_officer or tenant_admin. |
audit_hold_not_active (HTTP 409) | The hold is no longer active. | Nothing to release; create a new hold if needed. |
forbidden (HTTP 403) | Your role is not auditor, security_officer nor tenant_admin. | Ask one of these roles. |
| Approve release is missing | The hold is not active, or your role is not a hold role. | Read Status. |