When should immediate intervention take priority over preservation?¶

Preservation is important, but it is not always the first or only priority. Immediate intervention may be necessary where delay creates a greater risk than evidential change.

Evidential caution: that evidence must always be protected before anything else. In practice, life, safety, safeguarding, continuing harm and critical operational needs may require action first.

What this means¶

Examples may include stopping an active threat, preventing further financial loss, protecting a victim from ongoing account abuse, containing dangerous system activity, preserving essential public services or preventing the destruction of wider evidence.

The decision should be based on the actual risk, not general anxiety about what might happen. Ask what harm is occurring, how quickly it may escalate, what action could reduce it and what evidential consequences that action may create.

Where time allows, obtain specialist, legal, provider or organisational advice. In a genuine emergency, however, a recorded and proportionate decision may be more defensible than waiting while harm continues.

Document the state before intervention if this can be done without causing delay. Record who made the decision, what information was available, what alternatives were considered, what action was taken and what changed.

The correct question is not whether evidence or safety matters more in the abstract. It is which action best manages the real risks in front of you.

What to check or do next¶

• Use the least destructive effective response. It may be possible to isolate one account rather than shut down an entire service, block one transaction rather than close every access route or preserve visible information before changing credentials.
• Do not pretend that intervention had no evidential effect. A password reset may terminate sessions. A shutdown may remove volatile memory. Isolation may stop synchronisation. Those consequences should be recorded and explained.