What should be recorded before blocking, removing or revoking access?¶

Record the identities, relationship, permissions, relevant communications and current session state. Blocking or revocation may protect a user while permanently changing what participants and investigators can see.

Preserve the relationship before it changes¶

Retain stable account IDs, display names and profile URLs; conversation, group and channel IDs; roles, membership and permissions; linked-device details; request or following status; and relevant messages, threats, delivery and read indicators.

The action may create system messages, remove a session from the current list, invalidate invitations, alter membership history or hide content from one side. A linked session ended for safety may no longer be available for examination.

Document intervention as a new event¶

Where immediate safeguarding requires action, prioritise safety while capturing the pre-action state as fully as circumstances permit. Record the reason and authority, who acted, the device and account used, exact time, selected action and every resulting notification or visibility change.

Distinguish the original relationship and access state from conditions produced by the intervention. Do not assume reversibility will recreate the same records or permissions later.