Restricted Access

A protected report may involve a person whose identity needs a narrower audience than the matter itself. The restricted subject record carries a subject code, identity reference, access purpose, retention date and legal-hold choice. Case workers can use the report and matter records for ordinary work while the Records Custodian controls the protected identity record.

An access grant names the team member, subject, purpose, approver and expiry. A disclosure event records the recipient, date, scope and authority reference. Together these records help answer a concrete question: who was entitled to know the identity, for what work, and what was actually disclosed? The answer should not rely on a broad organization role alone.

• Identity. The Records Custodian keeps the protected identity reference under its own retention and hold rules.
• Access. A grant states the person, purpose, approver and end date for restricted access.
• Disclosure. Each external or internal disclosure records the recipient and authorized scope.

Define acceptable access purposes and who may approve each request. A grant’s expiry should reflect the specific investigation need. Agree how staff are removed from access when they leave the case or organization before the recorded expiry. Retention and legal hold need an owner who can resolve competing instructions before deleting or disclosing a restricted subject.

Set a clear boundary between reading a case attachment and reading the subject’s identity reference. A reviewer may need evidence for a decision without needing the protected identity. The disclosure record should include the authority reference that permits the recipient to receive the stated scope. A name in an email thread is not an adequate replacement for that record.

Create a restricted subject for a report and grant an Investigator access for a defined purpose and end date. Verify that an unrelated team member cannot open the identity record. At the end of the authorized period, inspect Restricted Identity Access and remove or renew access through the recorded approval route. Do not let a stale grant become standing access by habit.

If a regulator or designated officer must receive limited information, record the recipient, scope and authority reference as a disclosure event. Check that the disclosure covers only the information approved for release. The team should be able to reconstruct the grant and disclosure history without broadening who can read the underlying identity.

• Restricted Identity Access — Grants reaching their expiry date with subject, user and approver.
• Evidence Register — Case files whose visibility must match the recipient’s permitted work.
• Guarded Action Exceptions — Restricted operations needing review of their recorded outcome.

Follow identity access and evidence control.