Document / Record

Record identity anchor

The identifier that denotes the record independently of any file, version or rendition, its scheme, its granularity and its non-reuse guarantee.

1. Which system is the authoritative master for this record's identifier and from which registered scheme is the value drawn? identity
2. Does the identifier denote the record, one version, or one instantiation? definition
3. What guarantees that the identifier is never reused after disposition or system migration? constraint
4. Which legacy or alternate identifiers exist and on what basis are they asserted equivalent? interoperability

Designation and reference numbers

Titles, alternative and translated titles, and the official reference numbers quoted on the face of the record, kept strictly distinct from identity.

1. What is the official title of the record, in which language and script is it recorded, and who set it? definition
2. Which reference numbers appear on the face of the record and which authority allocated each? identity
3. How are superseded or translated titles retained without ever being treated as identifiers? constraint

Documentary form and genre

The documentary form the record takes (contract, certificate, invoice, minutes, licence) typed against a controlled vocabulary, and the rules that follow from that form.

1. What documentary form does this record take and from which controlled vocabulary is the term drawn? classification
2. Which obligations, signature requirements or retention consequences follow automatically from that form? requirement
3. Can one record carry more than one documentary form, such as a certificate inside a covering letter? composition
4. Who approves additions to the form vocabulary and how are retired terms handled? authority

Business classification and aggregation membership

Filing of the record under a classification class and its membership in aggregations, with the boundary to the archival aggregation model held explicitly.

1. Under which classification class is the record filed and which version of the scheme was in force at filing? classification
2. Which aggregations does the record belong to and is membership exclusive? composition
3. When the scheme is reorganised, is the historic class retained alongside the new one? temporal
4. If more than one class applies, which one determines retention and access? exception

Content structure, components and completeness

Which parts make up the complete record, which are essential to its meaning, and how completeness is verified at capture.

1. Which components make up the complete record and which of them are essential rather than incidental? composition
2. Which significant properties must be preserved for the record to remain usable and understandable? quality
3. In which languages is the content expressed and which language version is authoritative for interpretation? definition
4. How is completeness verified before the record is declared captured? validation

Version chain and immutability

How a content state is fixed, how versions supersede and amend one another, and the prohibition on editing an issued version in place.

1. Which event fixes a version and makes it immutable, and who is competent to trigger it? event
2. Which version is currently authoritative and which versions does it supersede or amend? state
3. How are drafts distinguished from issued versions for retention and access purposes? lifecycle
4. What reason, authority and change description are recorded for each new version? provenance

Instantiation, copy and original status

Format-specific and carrier-specific realisations of a version, and the legal distinction between the original of record, duplicates, certified copies and extracts.

1. Which instantiation is the original of record and where is it held? identity
2. Is a given instantiation a faithful rendition, a derivative, a certified copy or an extract, and who attests it? evidence
3. What criteria make a digitised surrogate acceptable in place of an analogue original? requirement
4. How are two instantiations of the same version proven to carry the same content? validation

Supersession between records

Dublin Core replaces/isReplacedBy model a related resource that supplants another. A new record may supersede an older record (policy, specification, licence) without being a version of the same identity. Supersession does not by itself authorize destruction of the replaced record; disposition remains a separate control.

1. Which earlier record(s) does this record replace, from when, and is the older identity retained? relationship
2. Has this record been replaced, and is it still retained under its schedule? state
3. Is the successor a new version of the same identity or a distinct record that replaces this one? definition

Format identification and rendering environment

How each instantiation's format is identified against registries and what software and hardware environment is required to render it.

1. Which registered media type and which format-registry identifier apply to this instantiation? measurement
2. How was the format determined — declared by the producer or identified by a tool? provenance
3. What environment is required to render the instantiation faithfully? requirement
4. What is the obsolescence risk for this format and what migration or emulation path is planned? decision

Fixity and preservation actions

Baseline digests, verification history, declared preservation level and the actions applied to keep instantiations readable, including those that change bytes.

1. Which algorithm and digest value were recorded at capture, and by which agent? evidence
2. When was fixity last verified, at what frequency, and what was the outcome? measurement
3. Which preservation actions have been applied and did any of them change the bytes? process
4. What happens when a fixity check fails, and who is notified? exception

Authorship and responsibility roles

Who authored, contributed to, approved and was addressed by the record, expressed as role-qualified references rather than embedded agent descriptions.

1. Which agent is the author of record and which agents merely contributed? ownership
2. Who approved or authorised issue, and under what delegation of authority? authority
3. Who are the intended addressees or recipients, and does that constrain access? relationship
4. How is a role recorded when the responsible agent cannot be identified? evidence

Ownership, custody and stewardship

The separation between the record owner and the custodian or registrar acting on the owner's behalf, and the terms limiting custodial power.

1. Who owns the record and who currently has custody of it? ownership
2. What may the custodian not do — can they widen access, migrate formats or dispose? authority
3. How and when does ownership itself transfer, and what evidence is required? lifecycle

Issuance, mandate and register entry

The legal basis and jurisdiction under which the record was issued, and the register entry that anchors it in a custodial system.

1. Under which mandate, statute or delegated authority was the record issued? authority
2. In which jurisdiction and at which place was it issued, and does that determine the applicable rules? spatial
3. Is the record registered, in which register, under what entry number, and at what instant? identity
4. Is the register public, and what is disclosed at existence level when content is withheld? access

Signature, seal and attestation

Signatures, seals and attestations applied to a version or instantiation, their assurance tier, their signatory and exactly what content each binds.

1. What signature or seal type was applied and at which assurance tier? evidence
2. Which exact content does each signature bind — a version, an instantiation, or a byte range? composition
3. Who is the signatory or sealing legal person, and on which certificate or credential does the signature rest? identity
4. What must hold for the signature to have legal effect in the governing jurisdiction? requirement

Timestamping and validation evidence

Trusted time-stamp tokens proving existence at a time, validation outcomes recorded with their own validation instant and policy, and the renewal of evidence before algorithms weaken.

1. Is there a trusted time-stamp token binding the content to a time, and which authority issued it? evidence
2. What was the validation outcome, at which validation instant, and under which validation policy? validation
3. How is the evidence renewed before its algorithms or certificates weaken? temporal
4. Which provenance manifest, if any, travels with the rendered asset, and does it survive rendition? interoperability

Authoritative record characteristics

ISO 23081 states that metadata must support assertions of integrity, authenticity, reliability and usability over time in business context. ISO 15489 requires records to remain authoritative through those characteristics: authentic (what it purports to be, created or sent by the purported agent at the purported time), reliable (trusted full and accurate content of the transaction), integrity (complete and unaltered), usable (locatable, retrievable, presentable, interpretable). These are assessed properties with evidence, not decorative flags.

1. Can this record be shown to be what it purports to be, created or sent by the purported agent at the purported time, and on what evidence? evidence
2. Has integrity been maintained (complete, unaltered since capture), and what unauthorized change if any was detected? quality
3. Can the record still be located, retrieved, presented and interpreted by the intended community? quality

Derivation and provenance graph

The activities that generated the record, the sources it derives from, and the agents associated with each generating activity.

1. Which activity generated this record or version, and when did it start and end? provenance
2. Which prior records was it derived from, and is the derivation a revision, an extract or a quotation? relationship
3. Which agent was associated with each generating activity, and on whose behalf did they act? ownership
4. Where a machine or model produced content, what tool, version and parameters are recorded? evidence

Chain of custody and hand-over

The gapless sequence of custody intervals, hand-over receipts and integrity checks that allows the record to be relied on as evidence.

1. Who held the record over each interval and are there any unexplained gaps? temporal
2. What receipt or acknowledgement evidences each hand-over? evidence
3. Was integrity verified at dispatch and again at receipt, and by whom? validation
4. How is the chain kept intact when a system migration rewrites storage or re-encodes content? exception

Record status and permitted transitions

The controlled status vocabulary, which transitions are permitted from each state, who may authorise them, and how withdrawal differs from destruction.

1. What is the record's current status and since which instant has it held that status? state
2. Which transitions are permitted from the current status and who may authorise each? lifecycle
3. Is withdrawal or revocation distinct from destruction, and does a revoked record remain discoverable? exception

Lifecycle events and audit trail

The append-only history of everything done to and with the record, using controlled event types with actor, outcome, event time and separately recorded observation time.

1. Which event types are recorded and from which controlled vocabulary are they drawn? event
2. Who performed each event, with what outcome and what detail? provenance
3. Is the trail append-only and how is its own integrity protected against tampering? security
4. How long is the audit trail retained relative to the record, and does disposition erase it? retention

Temporal anchors and validity periods

The distinct time anchors a record carries — created, issued, effective, expiry, received, observed — their precision, and the rule separating event time from ingestion time.

1. Which datetime is the legally or operationally decisive one for this record type? temporal
2. Over what period is the record valid or effective, and may the period be open-ended? temporal
3. How are event time and observation or ingestion time kept distinct in every record of time? provenance
4. How are dates of unknown precision or unknown local offset recorded? exception

Document versus captured record

ISO 15489 applies to records regardless of structure or form and treats capture into a records system as the act that places identified information under records controls. RiC-CM defines a Record as discrete information content formed and inscribed, at least once, on any persistent recoverable carrier by an agent in the course of activity. US 36 CFR 1220.18 / 44 U.S.C. 3301 additionally excludes extra copies kept only for reference, library or museum materials for exhibit, and personal files. This model stores a record-status on the object: document-not-captured, captured-record, nonrecord-copy, or jurisdiction-specific Federal-record, rather than splitting into two meta-models.

1. Has this object been captured as a record, and under which jurisdiction or policy is that determination made? classification
2. If it is a nonrecord, extra copy or personal file, what is the excluding criterion? classification
3. Who has authority to determine record status when systems or staff disagree? authority

Retention class and disposition authority

The retention class assigned to the record, the instrument authorising it, the trigger that starts the clock and the action due at the end.

1. Which retention class applies and under which authority instrument and citation? authority
2. What event triggers the retention clock and how is that trigger detected? event
3. Is the record permanent or temporary, and what disposition action falls due at the end of the period? decision
4. When two schedules apply to the same record, which one prevails? exception

Holds and disposition suspension

Legal holds and other suspensions that override retention schedules until explicitly released, and the mechanism that prevents automated disposal of held records.

1. What is the scope of the hold — this record, its aggregation, or a query-defined set resolved at a moment in time? composition
2. Who placed the hold, under what proceeding or authority, and when? authority
3. What must be true before the hold can be released and disposition resumed? constraint
4. How is hold state surfaced so that no automated process can dispose of a held record? security

Disposition execution and surviving evidence

Carrying out destruction, transfer or permanent retention, and the evidence and tombstone that outlive the record itself.

1. Who authorised the disposition and was the absence of any hold verified at that moment? authority
2. What method was used and is it verifiable as irreversible for the carrier concerned? process
3. What evidence survives destruction and which metadata fields are kept as a tombstone? retention
4. For transfer, what accession identifier and integrity proof did the receiving body return? interoperability

Access conditions and security marking

The security marking and access restriction status carried by the record, the statutory regime behind them, and the recorded decisions on individual requests.

1. What security marking and access restriction status does the record carry, and who set them? access
2. Which statutory access or exemption regime applies, and for how long does the restriction run? authority
3. What is disclosed at existence level when the content itself is withheld? privacy
4. How are grants, denials and emergency access events recorded and reviewed? evidence

Rights, licensing and personal data

Who holds rights in the content, under what licence it may be reused, and what personal data within it constrains processing and release.

1. Who holds rights in the content and under which licence may it be reused? ownership
2. Does the record contain personal or special-category data, and on what lawful basis is it processed? privacy
3. What redactions produced the releasable derivative, and is the unredacted source preserved intact? process

Metadata alignment and conformance evidence

Which external standards the record's metadata is mapped to, where mappings lose information, and what evidence is required before any conformance claim is made.

1. Which external standards is this metadata mapped to, and at which version of each? interoperability
2. Where does a mapping lose information or contradict another target, and how is the loss recorded? quality
3. What evidence supports any conformance claim, and who validated it? validation

Exchange packaging and projections

How a record and its evidence are packaged for transfer or publication, and how each projection deliberately omits parts without breaking reconstructability.

1. What package structure and manifest are used, and how is package integrity proven on arrival? interoperability
2. Which projection is being served and which fields does it deliberately omit? access
3. How does a receiving system reconstruct identity, version chain, fixity and events from the package alone? validation
4. Which media types, character encodings and normalisation rules apply to the payload? constraint