Evidence snapshots
Quick start

OneView documentation

Evidence snapshots

Link live source records while preserving bounded immutable evidence.

Evidence snapshots

Linked evidence has two related views:

  • The live source link opens the current source record when the viewer still has the necessary source permission and Module entitlement.
  • The case snapshot preserves bounded information captured at link time, together with a SHA-256 digest and capture timestamp.

This design lets a reviewer compare the current source with the information used during the investigation without silently changing the historical record.

Adding evidence

Open a case, select Evidence, and then select Link evidence. Choose a supported source type and provide the source record identifier. OneView resolves the record through a compiled adapter for that source type. The request cannot provide a database table, SQL fragment, arbitrary model, or caller-authored snapshot.

The same source record can be linked only once to a case. If a later snapshot is needed, retain it as a new snapshot through the approved refresh workflow when that capability is available in the installed release.

Access boundaries

Case evidence has two access checks:

  1. cases:evidence:read controls access to evidence inside the case.
  2. The source permission controls whether the user can link or follow the live source record.

Examples include transactions:read for a transaction, verifications:results:read for a verification result, rules:read for a transaction rule, and audit:read for an activity event.

Removing a source Module from a later license does not delete evidence already preserved in a case. The historical case record remains, while the live source link remains subject to the current license and permissions.

Evidence handling

  • Do not copy API keys, passwords, access tokens, private keys, or other secrets into case notes.
  • Use the RESTRICTED classification only under the institution's approved need-to-know policy — it is enforced by cases:restricted:read, not just a display label. See Case governance.
  • Exported or copied case information remains subject to the client's retention and disclosure obligations.
  • A snapshot digest proves whether the stored JSON changed. It does not, by itself, prove that the source system was correct.