/ 01What the steward sees
Each silo has at least one designated steward — typically a Knowledge Management lawyer or senior fee-earner. They see:
- Items pending review, sorted by classification desc, ingest-age asc
- SLA visibility per priority class (countdown to breach)
- Side-by-side source extracted text + generated asset (facet / abstract / redacted view)
- Edit-in-place for L3 and L4 assets
- Approve · Reject · Escalate-to-author actions
- Bulk approve for low-risk batches
- Filter by author, classification, source DMS, age
/ 02SLA per classification
| Classification | Target | Action if missed |
|---|---|---|
| Privileged | 4 hours | Alert tenant admin; surface on dashboard |
| Restricted | 24 hours | Alert silo admin |
| Confidential | 72 hours | Alert silo admin (warning) |
| Internal | 7 days (5% sample) | Audit-only |
| Public | None | — |
SLA windows count from ingest time. Pausing a queue item (e.g. awaiting author response) freezes the SLA clock; resuming restarts it.
/ 03Side-by-side review
The review UI shows three things at once:
- Source — extracted text with span highlighting where the generated asset drew from
- Asset — the L3 abstract or L4 redacted view, editable in place
- Metadata — classification, jurisdiction, owning silo, author, AI prompt version, model version
Stewards approve as-is, edit and approve, reject with reason, or escalate-to-author. Edits are tracked: the original generated asset and the steward's revision are both preserved (see asset versioning).
/ 04Reclassification cascade
When a steward reclassifies a document, the consequences cascade through every related artefact and access. The cascade is the heaviest single operation in Atrium.
Conflict pre-check
If the reclassification would expose across an ethical wall, the operation is blocked and routed to group compliance.
Asset regeneration
L2, L3, L4 are regenerated against the new ceiling. L3/L4 above Internal queue for mandatory re-review.
Index updates
OpenSearch, pgvector, AGE, and Postgres are all updated to reflect the new classification.
Prior-access scan
The audit log is scanned for prior access to this resource. Accesses above the new ceiling become over-disclosure incidents.
Grant revocation
Existing access grants above the new ceiling are revoked. Grant holders notified.
Claim cascade
Claims sourced from this document inherit the new classification by default (per-claim overrides preserved).
Over-disclosure incidents at severity ≥ medium trigger a post-incident review. If personal data is involved, the GDPR Art. 33 72-hour clock starts automatically.
/ 05Bulk operations
Bulk reclassification (> 100 documents) requires group-compliance sign-off and a written reason. The bulk engine is throttled, resumable, and observable — the same machinery as backfill.
Per-item review still runs; the bulk operation merely schedules them in order. Cancel mid-flight: the in-progress batch completes, the rest is undone.