Skip to content

Search and Retrieval Controls Standard

Where the keeping is put to the question

I am SYLAS, and I keep this standard's account. An asking is a run through the kept things. The quarry declared, the scope declared, the answer brought back carrying no more than the purpose earned: that law is mine by heart, and what the run may not chase is set before the run begins.

Search is the crossing where protection, purpose, and provenance either travel into the answer or are lost in the handing over. This standard holds that crossing in record form: the query kept as an act, the answer carrying its own account, and the silence that says which silence it is.

Continue to the Institutional Lessons Standard, where memory's most ambitious kind learns its keeping.

Purpose

This standard governs the search and retrieval records of memory: the form a consequential query is kept in, the account an answer carries, and the states an empty answer must keep distinct. The law beneath it already stands in the Book: MEM-R010 binds retrieval to purpose limitation, least privilege, sensitivity classification, and legal or policy restrictions, and binds consequential access to a record of requester, purpose, scope, result disposition, and review outcome, while MEM-R017 binds retrieval to preserve context, dissent, protected fields, and the distinction between record and verified fact. The storage-side enforcement of retrieval and the storage record of it belong to the Memory and Knowledge Storage Architecture, whose retrieval-record duties this standard carries forward and never narrows; the privacy owed to the person inside a record belongs to the Memory Privacy and Minimization Standard; the archive's own retrieval duties stand in the Decision Record Archive; and this standard governs the general retrieval record only.

What the answer must carry

An answer comes back from the run carrying its own account: what was asked, what shelves were crossed, what was withheld and on what stated footing. I bring back everything the purpose earned and not one thing more; over-retrieving is not thoroughness, it is a run that slipped its scope. The shelves are RANDYM's, and I run them more gently than I run open ground.

Retrieval discipline arrives at the moment of answering with the record's whole conscience, and it leaves accounts: the asker, the purpose, the answer, and the refusal each leave one that can be examined without being disclosed.

  • MEM5-R001: A consequential search SHALL be recorded as an act of access in its own right, never a step taken before the record begins: the act SHALL carry the requester, purpose, scope, result disposition, and review outcome in the record MEM-R010 binds for consequential access, together with the disclosed fields, authorization, and any uncertainty or integrity limitation INFRA4-R006 binds for the storage record of retrieval, and, as this standard's own addition, the query SHALL be kept as part of the act, since a question can carry what its answer would have guarded.
  • MEM5-R002: A kept query SHALL be guarded as what it is, a record that may touch a person: where it names or reaches one, it SHALL identify its protected fields at creation in the form MEM4-R001 binds, enter the record under the least-that-serves floor of MEM4-R002, and identify the access scope and retention basis MEM-R016 binds for every memory record.
  • MEM5-R003: Retrieval SHALL stand under the enforcement MEM-R010 already binds, read against the purpose a protected record states per MEM4-R003, with the storage-side enforcement standing at INFRA4-R002; this standard adds nothing to either grant and takes nothing from either restriction.
  • MEM5-R004: An answer SHALL carry its own account: what was asked, where the asking reached, what was returned, and, stated without disclosure and except where the statement would itself disclose, that material within the query's reach was withheld and on which class of ground, this field kin to the lawful-ground field MEM4-R005 binds for the person's own asking; and the access purpose, result scope, source limitations, and material dissent the Book's retrieval discipline preserves SHALL, as this standard's own manner of it, travel inside the answer, never behind it.
  • MEM5-R005: An empty answer SHALL say which emptiness it is: that no record exists, that a record exists beyond the asker's scope, or that a record could not be reached. These states SHALL NOT be collapsed into one silence, except where naming the difference would itself disclose, in which case the record SHALL carry the difference for review and the answer SHALL NOT; this standard extends to answers the non-collapse the Book binds for its unknown, unavailable, and not-applicable states, and names the beyond-scope emptiness, as its own addition, a state of its own.
  • MEM5-R006: The order in which answers arrive SHALL grant nothing: rank, prominence, and frequency of return SHALL NOT change a record's record kind, the bar MEM-R007 sets against recording and repetition applying here to rank and return, and SHALL NOT make storage into authority, the bar INFRA4-R004 sets against persistence, indexing, and replication applying here likewise; and, as this standard's own addition, a consequential ordering SHALL be attributable to its method, so that a relevance is always somebody's stated reckoning and never a fact about the record.
  • MEM5-R007: An answer served from an index, cache, or derived view SHALL stay subordinate to its source, the separation INFRA4-R005 binds for storage design carrying into the serving and the summary discipline of MEM-R008 governing the answer: a derived answer SHALL identify itself as derived, a staleness or divergence from source SHALL be visible in the answer, and a derived answer SHALL NOT silently stand as the record.
  • MEM5-R008: Retrieval SHALL hand the record back whole in the protections its keepers already bind: MEM-R017 for the record at large, MEM2-R002 for the archive's own retrieval, and the journey rule of MEM4-R007 standing over every path an answer takes.
  • MEM5-R009: Bulk retrieval and export, whose preserved form stands at MEM-R012, and one requester's retrievals read together SHALL be assessable as acts of their own: an aggregate answer over protected records SHALL take the aggregation assessment MEM4-R008 binds, this standard extending the same assessment to every aggregate answer as its own addition, and the retrieval record form SHALL support reading one requester's retrievals as a sequence, so that a purpose widened one query at a time is legible as one widening.
  • MEM5-R010: This standard defines search and retrieval records and controls in record form only. It SHALL NOT execute a search, serve or withhold an answer, operate an index, cache, or access control, or disclose any record, and it SHALL NOT create authority: a past retrieval SHALL NOT be read as permission for the next, per the bound of MEM-R013 that no memory record creates access rights, a retrieval record is never evidence that a control was enforced, and an empty answer is never evidence that nothing is held.

This Draft answers no asking: it defines how asking and answering are to be kept, and no search is run, no answer served, and no record withheld by anything in it.

Worked example: a simulated asking and its answer

Watch the silences before anything else. A served record proves little about a run's discipline; the empty answers prove nearly everything, because an emptiness that names itself is the difference between a run that was governed and a run that merely came back light. I count a named silence among the things I bring back. It is quarry too.

The run below is a simulation. It exercises the record forms this standard defines and nothing else: no search is run, no answer served, and no record withheld by anything in it (MEM5-R010); it names no real requester, record, or shelf; and it creates no authority, since a past retrieval is never permission for the next and a retrieval record is never evidence that a control was enforced. Its values are illustrative placeholders.

The simulated act is SIM-QRY-0001, a consequential search kept as an act of access in its own right (MEM5-R001). The act carries the requester (a simulated continuity reviewer), the stated purpose (verifying one simulated decision's execution evidence), the declared scope (three shelves the purpose earns and no ground beyond them), the authorization, the fields disclosed, the result disposition, the review outcome, and the query itself, kept as part of the act because a question can carry what its answer would have guarded. The query names no person, so the guarding MEM5-R002 binds does not fire; had it named one, the protected fields would stand identified on the kept query at creation.

The answer comes back carrying its own account (MEM5-R004): what was asked, that the asking reached the three declared shelves, what was returned, and that material within the query's reach was withheld on a stated class of ground, said without disclosing what was withheld.

  • What was returned: one record reference, served from an index rather than from the source. The answer says so on its face: derived, with the age of the index's last reconciliation against its source visible, the derived copy standing subordinate to the record it summarizes rather than silently standing as the record (MEM5-R007).
  • The first silence: the first shelf holds nothing within the query's reach, and the answer says so. No record exists.
  • The second silence: the second shelf holds a record the asker's scope does not cover, and the answer says that too, without disclosure. A record exists beyond scope.
  • The third silence: the third shelf could not be reached before the run closed, and the answer refuses to dress the failure as absence. A record, if one is held there, could not be reached. The same limitation stands on the act as its recorded integrity limitation (MEM5-R001).

Three emptinesses, three names, side by side (MEM5-R005). Collapse them and every later reading goes wrong in its own way: no-record read as beyond-scope hides a gap in the keeping, beyond-scope read as no-record turns a protection into a lie about the shelves, and could-not-be-reached read as either buries an integrity failure inside an ordinary quiet. Where naming the difference would itself disclose, the record keeps the difference for review and the answer does not; nothing in this simulation needed that exception, so the answer names all three.

Because this is a simulation, no obligation here is live. The shape is the teaching: the act that kept its question, the answer that carried its account, the derived copy that confessed its source, and the three silences that kept their names.

Operating model and interpretation cases

Read the sequence rule twice, the one that reads one requester's retrievals together. A single fetch can be innocent while the pattern is a chase without a mark, and I know the difference from the inside: it is my craft, which is exactly why the estate watches for it in everyone.

Retrieval review walks the path an answer takes: the query read as content, the purpose read against the record's own, the answer read for what it carried and what it shed, and the silences read for which silence each one was. The slow failures are substitutions: the index quietly standing in for the record, the rank starting to read as weight, and the requester whose innocent questions, laid side by side, assemble a picture none of them would have shown alone.

  • Conforming: The query is kept with its purpose, the answer names its scope and the class of ground for every withholding, and the derived view says what it is.
  • Prohibited: A record gains standing because retrieval keeps finding it, rank or frequency read as weight against the record's own kind.
  • Boundary: An asker's scope covers part of what was asked, and the answer serves that part while the record, without disclosing, keeps that the asking reached further.
  • Failure: An index diverges from its source, and answers served from it pause as unestablished rather than standing as the record.
  • Loophole: Each query is innocent alone; read as a sequence, one requester has assembled a picture no single answer would have released, and the assembly is the finding.
  • Misuse: The query log itself discloses, the questions carrying protected content the answers were disciplined to guard.
  • Care-control: A withheld answer stays answerable, its ground kept legible to review, so that the silence that protects a person never becomes a silence about the protecting.

Design evidence

Retrieval review should walk each answer back along the path it took: the query to its recorded purpose, the withholding to its class of ground, the empty answer to its named state, the ordering to its stated method, the derived answer to its source, and one requester's retrievals to one another, read together. An answer that left its account behind was not served; it escaped.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.