Day 4 — Reason about clocks without inventing a deletion deadline
Learning decision. A retention claim is not a deadline until its dataset, anchor event, configuration and observed behavior are known. The phrase “24 hours” in C01 might describe source event age, collector query visibility or export artifact life. An analyst who adds 24 hours to the time C01 was read has chosen an anchor unsupported by the worksheet. NIST SP 800-92 motivates planned log-management processes; it does not determine CTN's storage policy or the safety of waiting until a calculated minute.
For a separate W1 arithmetic illustration, suppose a synthetic event has event time 08:00, collector receipt 08:07 and export creation 08:10 UTC on day D. Under three different hypothetical 24-hour policies, nominal cutoffs would be D+1 at 08:00, 08:07 and 08:10 respectively. Those values are conditional calculations, not confirmed expiry times: clock error, ingestion delay, policy exceptions and query lag remain unmeasured. A fourth possibility is that “24 hours” is a contractual objective not implemented by any of those components. Ask the application and logging custodians which dataset and clock each rule covers, and test retrieval in an approved nonproduction environment before scheduling any edge-of-window exercise.
Now separate retrieval latency from retention. In the proposed S41 rehearsal, if an authorized training event occurs at 09:00 and the verified matching producer/export receipt is obtained at 09:19, the 20-minute goal passes for that test. A query submitted at 09:19 but a usable, checked record obtained at 09:23 fails that goal. An analyst's screen showing “found one result” is not yet a verified receipt if the slot, request key, source and time basis were not checked. Conversely, missing evidence from a broad query is not a measured expiration. State precisely where measurement starts and ends.
Worked example. A supervisor asks, “Can we defer the rehearsal until tomorrow at 08:40?” The correct answer is “C01 cannot support that decision.” If the source-event policy from the illustration applies, a day-D 08:00 event would reach its nominal D+1 08:00 boundary before the proposed meeting. If the export-artifact rule applies instead, the meeting may still be too late or irrelevant because no export was created. The conservative action is to obtain the custodian's policy and a permitted earlier test, not to declare that a 24-hour deadline has been proven.
Practice. Complete EX004 with three plausible interpretations of “24 hours,” a different required owner record for each, and a cautious next action. Use the worked answer to check the reasoning. Limit: simulated arithmetic does not measure clock skew or prove actual retention. Previous: Day 3 · Week index · Next: Day 5.
Exercise for this lesson
EX004 — Retention ambiguity. Input: “API audit: 24 hours” in C01. Give three plausible meanings, one question to the custodian and a conservative readiness action. A 2-point result does not calculate a deletion deadline from an unanchored claim.