Visibility: what you can measure

Why it matters

A compliance question is answered from records you were already keeping. This lesson makes you choose those records before members get access, not after.

What to practise

Separate three records: the Compliance API (conversation and file content, plus audit log events), OpenTelemetry (how the surfaces are running), and retention (how long content is kept). Note that audit logs alone are metadata-only, that the shortest custom retention window is 30 days, and that compliance records follow their own retention. Then assemble the lesson’s brief: a retention window matched to existing policy, a Compliance API recommendation with a named reader, and a destination for telemetry.

How it fits

The routed, reviewed record is the audit evidence 5.4.1 ties to each control. Retention is the deletion obligation that 5.4.2 carries through every copy, and the lesson warns that shortening the window deletes history for good. Its inference hooks, which block content before it reaches Claude rather than governing it by retention afterwards, are the minimization 5.4.2 asks for.