Build in the expiry

Go and look at how long your system keeps a finding. Not the raw log — the finding: the risk flag, the fraud score, the adverse determination, the attribute you stamped on a record and then used to decide something. In most systems the answer is the same, and nobody chose it: forever. The finding is written once, and from then on it is available, current, and load-bearing every time the person it describes comes back through the door. It was never given an end. And an end is the one thing a consequential judgment most needs, because the circumstance that justified it will not last as long as the record of it does.

This is a build decision you are making by default, and almost always in the wrong direction. When you store a determination without an expiry, you are not being neutral about time — you are ruling that the judgment is true until the heat death of the database. You are deciding, silently, that a person can be held to who they were on the worst day you happened to record, for as long as that row survives. Nobody signs off on that ruling because nobody sees it being made. It falls out of the defaults: retain what you write, resurface what you retain, and let a finding keep counting long after the thing it was about has changed.

The life sentence you shipped by accident

Human institutions understand that permanence is a form of punishment, and they build against it on purpose. Statutes of limitation close the window in which an old act can be raised against you. Expungement and record-sealing let certain findings stop counting. Credit information ages off on a schedule. None of this is sloppiness or lost paperwork — it is deliberate forgetting, encoded into law precisely because a society that holds everyone forever to everything is not a just one. The forgetting is designed. It is a feature of the institution, argued over and written down, because the institution learned that a judgment which never lapses becomes an injustice no matter how sound it was the day it was made.

Software inherited none of that wisdom and all of the opposite reflex. Its native tendency is to retain and to resurface, because storage is cheap and recall is a feature. So a flag raised during one bad quarter keeps firing three good years later. A fraud score computed against a pattern of behavior the person has since abandoned still greets them at every gate. An adverse finding entered when a fact was fresh goes on being treated as fresh long after the fact has decayed. The circumstance moved; the determination did not, because nothing in the system was built to let it. That is the accidental life sentence — not a cruelty anyone intended, but the compounding output of a default nobody revisited.

Software forgets nothing unless you build it to — and a system that forgets nothing will hold people forever to who they were on their worst recorded day.

Give every judgment a shelf life

So the directive is this: when you record a consequential determination, record its expiry in the same breath. Three things, bound to the finding itself. How long it should be treated as current — a stated shelf life, chosen deliberately for this kind of judgment rather than inherited from the storage engine. What triggers its re-examination — the event or the elapsed time that says this determination is now old enough, or the world has shifted enough, that it must be looked at again before it is trusted. And what happens when it lapses — whether the finding is dropped, downgraded to a weaker signal, or forced through a refresh that either renews it on current evidence or retires it. A determination without those three fields is not finished. It is a judgment with no way to end, which is to say a judgment you have quietly decided will never be wrong.

This is the engineering that makes the softer principles real. It is easy to say that facts have a half-life and that people can earn a second chance; those are true and they are inert until something in the system acts on them. Expiry is the mechanism that acts. A shelf life is how the half-life of a fact stops being an observation and becomes a rule the software obeys. A lapse-and-refresh path is how earned forgetting stops being a sentiment and becomes a state transition. You are not adding compassion to the system as a garnish. You are encoding, in software, the same deliberate forgetting that institutions encode in law — because both are answers to the same problem, which is that a judgment allowed to persist unexamined will outlive its own warrant.

Treat “retain forever, resurface always” as the choice it is, and make it consciously in the rare cases where it is right, rather than universally by omission. Most determinations should not be permanent, and the ones that should can say so explicitly. The point is that the duration is now a governed parameter — visible, reviewable, defensible — instead of an accident of the fact that you never wrote an end date.

Expiry is not amnesia

Now the honest tension, because there is one and it matters. Some records must be kept. Legal holds, safety-critical history, the audit trail that lets a past decision be reconstructed and contested — none of that can be allowed to evaporate on a timer, and expiry must not touch it. But this is only a contradiction if you collapse two different things into one. Distinguish them. There is the operative currency of a determination — how long it should be permitted to drive a decision — and there is the permanence of the record that the determination was made — the fact, kept for accountability, that on this date, on this basis, this judgment was reached. Expiry retires the first. It never touches the second.

So building in the expiry is not deleting the past; it is dating it. The finding that a person was flagged in a given year, the evidence it rested on, the policy in force at the time — all of that stays, permanently, because that is what lets the person contest it and what lets you answer for it. What lapses is the finding’s force: its standing to keep counting against someone in live decisions once its shelf life has run and no one has renewed it on current evidence. The audit trail remembers that the judgment happened. The decision path stops treating it as true. Those are different jobs, and a system that can do only one of them is either an amnesiac or a jailer.

Do this at the point where the determination is written, not as a cleanup pass bolted on later — because a lapse rule invented after the fact cannot know what any given finding was for or how long it deserved. Give the judgment a shelf life, a trigger for re-examination, and a defined behavior on lapse, at the moment you record it. Keep the record that it was made for as long as accountability requires. Retire the finding’s force on the schedule justice requires. A determination that can end is the only kind you can defend holding — and the only kind that lets the world move on from a person the way the person already has.

— Dispatches · Summit Cognitive