---
id: ADR-PFM-ELG-007
title: 'Decisions are append-only, sampled for display and kept thirteen months'
product_area: platform
module: eligibility
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Select authorization, transactional and indeterminate answers for recording
  and sample other display answers at a configurable rate, with one in twenty as
  the default.
constrains:
  - DOM-PFM-ELG-003
  - SVC-PFM-ELG-eligibility
  - WF-PFM-ELG-004
  - WF-PFM-ELG-009
origin: >-
  Eligibility Engine architecture D-10 (decision records kept 13 months; display
  decisions sampled), approved by Andrew 2026-10-17 (PLAT-M11 "Decisions");
  row-level security standard exemption recorded in the module record
alternatives:
  - option: Persist every display answer
    why_not: High-volume page reads would produce substantial repetitive history.
  - option: Apply the ordinary workspace row policy to history
    why_not: Pre-workspace authorization reads need the documented policy exemption.
consequences:
  - Ordinary application access is insert and read only.
  - History queries explicitly constrain the workspace.
  - Restricted purge and retention remove rows.
  - >-
    Display inserts are deferred and can be lost; the SQL-only check inserts no
    history.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6:
    docs/proposals/eligibility/17-decision-register.md;
    docs/milestones/PLAT-M11-eligibility-rules.md (Decisions)
  - >-
    services-platform at ad3f6a6: docs/eligibility.md §3, §4, §9.4, §9.5;
    docs/row-level-security.md
---
# Decisions are append-only, sampled for display and kept thirteen months

## Context

Audit value and display traffic require different recording policies.

## Decision

Select authorization, transactional and indeterminate answers for recording and sample other display answers at a configurable rate, with one in twenty as the default.

## Alternatives Considered

Persist every display answer: High-volume page reads would produce substantial repetitive history.

Apply the ordinary workspace row policy to history: Pre-workspace authorization reads need the documented policy exemption.

## Consequences

Ordinary application access is insert and read only. History queries explicitly constrain the workspace. Restricted purge and retention remove rows. Display inserts are deferred and can be lost; the SQL-only check inserts no history.