The lifecycle: authorization to closure
The safest design is a finite state machine whose transitions require explicit evidence. A case should not be a set of scripts or tickets. It should have controlled states, allowed actors, validation rules, deadlines, and irreversible audit events.
Safety boundary: this chapter teaches lawful, governed system design from public standards. It does not provide operational targeting, activation, decryption, surveillance-evasion, or covert collection instructions.
The mental model
| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| Received | A request entered controlled intake | No provisioning yet |
| Validated | Authority, scope, dates, and jurisdiction passed review | Validation evidence is immutable |
| Approved | Required internal dual control completed | Approvers cannot be the requesting operator |
| Provisioned | Authorized scope reached relevant functions | Activation acknowledgements are reconciled |
| Active | Permitted observations may be produced | Continuous expiry and scope checks remain |
| Closed | Collection stopped and post-case duties completed | Closure includes de-provisioning and retention outcome |
Apply it as a controlled workflow
- Normalize the request without discarding the signed original.
- Validate authority and translate bounded scope.
- Run dual approval and conflict checks.
- Provision with an idempotent case operation and collect acknowledgements.
- Monitor completeness, scope, health, and expiry without exposing payload.
- Stop, de-provision, reconcile, record receipt, and execute retention policy.
Evidence to demand
- Every state transition has actor, reason, time source, prior state, and authorization reference.
- Repeated requests are idempotent and do not create duplicate collection.
- Expiry is enforced autonomously even when control systems are unavailable.
- Closure reports unresolved gaps, incidents, delivery receipts, and deletion holds.
Failure to reason about
A maintenance outage hides the expiry scheduler. Collection continues after legal end time. Availability engineering must include lawful stop behavior: local expiry enforcement, monotonic state, protected time, and an alarm that does not depend on the failed control plane.
Feynman check
A case behaves like a train with gated stations. It cannot jump from request to collection, and at the final station every carriage must stop and be counted.