Authorization comes before access
Work can only involve systems, accounts, devices, records, or evidence for which appropriate authorization exists. Where that authorization is unclear, establishing it is the first task rather than a formality to be worked around.
Where a matter proceeds, retention scope is agreed explicitly and in writing. Reviewability long after an event is a design goal, not a promise, and it holds only where the available source evidence and chosen retention scope support it. Evidence that no longer exists cannot be recreated.