Review private evidence in a case

Briard Alert & Response Console (BARC) watches event metadata by default. To examine prompts, answers, or files, open the incident case and use Private evidence. The case guides each request, approval, and evidence review. Briard keeps the selected case through sign-in; it does not copy private content or grant access.

1. Ask for a closer look

Choose Request deeper investigation, then pick what you need:

Choice	What you get
Check content and show findings	An approved source examines content inside your environment. The case keeps findings and receipts, without keeping original content as case evidence.
Read original evidence	An approved source holds only the selected originals for review. In the same case, an authorized evidence reviewer chooses which items to keep and open.

Neither choice is selected for you. Keep metadata only, cancelling, or leaving a draft sends nothing. A request cannot recover content that the original source does not hold or cannot provide.

Choose the named source and explain why the case needs a closer look. BARC fills in verified case details, file limits, and approved storage settings. Review the proposed time range and material. For originals, choose How many days may we hold originals for review? The holding period starts when you send the request. The screen shows its exact end date. Collection permission has its own, separate expiry.

The screen explains what your role may do. Asking for originals does not change your role or let you open them. If you need an evidence reviewer, the case shows that handoff. A missing source, privacy rule, or storage setup needs an authorized administrator; manual technical IDs are not a substitute for permission.

2. Review access and wait for approval

Review what may be examined, the reason, the limits, the holding period, and the required reviewers. Technical details retains exact source, policy, and evidence identifiers. Meaningful privacy and retention decisions stay visible.

Confirm This is the least evidence I need, then Send for approval. Submission saves a request. Two different eligible people other than the requester must approve the exact scope before collection can start. Reviewers record a reason and may deny the request. I'm not sure grants nothing.

The case distinguishes waiting for approval, approved but not started, collection in progress, partial results, and completed collection. Approval alone is not proof that a source ran. Unknown status stays unknown and offers a retry.

3. Choose the originals to keep

When originals arrive, Original evidence for this case shows the actual items and next step. The collection receipt establishes their source, file type, size, and fingerprint. It does not mean the originals are ready to open.

An authorized evidence reviewer selects an item and supplies the purpose and How many days may authorized reviewers open it? BARC prepares the exact request from the saved receipt and approved storage configuration. This period starts when you send the item request. The case shows when access ends and how long the stored copy is protected from deletion. Users do not copy IDs or keys, calculate fingerprints, or download and re-upload files.

Keeping the exact item has its own two-reviewer approval. The case presents it as the next step in the same journey. The product cannot silently reuse a general collection approval for a specific original and retention period. The requester cannot self-approve, and one reviewer cannot count twice.

4. Let BARC prepare the evidence

After exact-item approval, the approved customer-side worker verifies and decrypts the matching protected copy, checks current authority, and transfers it into the approved evidence store. The case shows Preparing evidence until the server has confirmed the stored object and its integrity.

A failed transfer explains whether the approved worker can retry or a source operator needs to repair the source. An authorized reviewer can request a bounded retry after repair; that retry keeps the exact scope, approvals, and expiry. It does not authorize a different file. BARC does not ask the user to move the file manually.

When the case says Ready to review, an eligible reader supplies a reason and opens or downloads the approved item. Each access is recorded. Text and prompts are shown as inert text; original content is not placed in ordinary event telemetry, Briard governance records, or routine evidence packages.

What happens when time runs out?

Collection permission ends at its saved expiry. That does not prove previously collected evidence was deleted.

Temporary copies have the separate holding deadline you approved. The worker requests fresh cleanup permission after that deadline, checks the exact object and legal-hold/preservation state, and records its cleanup report. A legal hold can block cleanup. A collector report is not independent proof of deletion from a customer's storage or the original source.

When a case enters controlled disposal, new collection and original-content review stop. The approved worker can still clean up temporary copies after their deadline. An authorized reviewer can place or release a case hold, with a recorded reason. The hold pauses Briard's cleanup of remaining copies; it does not restore deleted files or extend permission to open content.

For items kept with the case, ordinary content access ends at the displayed deadline. The stored copy is protected from deletion at least through that date. It then awaits the separate controlled disposal process; the date does not promise automatic deletion. A legal hold can preserve the copy longer but does not extend permission to open it. Copies at the original source, and copies a reader downloads, have separate handling responsibilities. Historical requests without an explicit temporary-copy holding decision gain no invented permission to delete evidence.

If the next step is unavailable

What the case says	Next step
No linked case	Use Create a case to continue if your role permits it.
Your role cannot request, keep, approve, or open an item	Use the displayed authorized investigator or evidence-reviewer handoff. The request does not change your role.
Source, privacy rules, or storage is not ready	An authorized administrator completes the stated setup. Keep the case context and return to its request.
The source worker needs an update	A source administrator installs the approved worker version. Return to the same case; updating a worker does not renew an approval or extend its deadline.
Source or policy changed	Review the saved reason. The original approval does not cover changed scope.
Transfer failed	Read the permitted repair or retry step. An item is not ready to open until storage is confirmed.
Sign-in is old	Complete the existing sign-in or phone-code check; the selected case resumes with fresh access checks.
Status cannot be loaded	Retry. Do not infer that access is off, on, or complete.

For source setup, see Connect sources. For the boundaries, see Security and data boundaries. For help, send safe record identifiers and timestamps to support@briard-ai.app; keep source content and credentials out of support messages and ordinary case comments.