When should immediate intervention take priority over preservation?¶

Intervene when a real and time-sensitive risk to life, safety, finances, systems or wider evidence outweighs the evidential cost of changing the immediate source.

Compare the harm of acting with the harm of waiting¶

Possible reasons include an active threat, continuing account abuse, ongoing fraud, dangerous system activity or disruption to an essential service. Define the harm, how quickly it may escalate and which action could reduce it. General anxiety is not the same as demonstrated urgency.

Where time permits, seek specialist, legal, provider or organisational advice and record what was available. In a genuine emergency, a proportionate decision based on the information then known may be more defensible than delaying for an ideal response while harm continues.

Use the least destructive effective option¶

It may be possible to block one payment rather than close every account, isolate one endpoint rather than stop an entire service or preserve a visible screen before changing credentials. Record the original state first where that does not materially delay protection.

Document who decided, the information available, alternatives considered, the action and its effect. State evidential consequences directly: password resets can terminate sessions, shutdown can remove memory and network isolation can stop synchronisation or monitoring.

Review after the intervention. If the immediate objective has been achieved, stop; urgency should not expand into an uncontrolled examination. The recorded decision cycle should show why the chosen action was necessary and proportionate in the circumstances.