Courts IT is retiring an obsolete case-summarization model that stored embeddings derived from sealed records. What lifecycle control should security prioritize?

Disposing of or cryptographically rendering inaccessible the sealed-record embeddings once the model is retired is the action that honors the seal. Sealed records remain sealed even when embedded in a model; embeddings are a derived form of the original data. Once the model is no longer in use, the embeddings—learned representations of sealed case details—must be deleted or cryptographically destroyed (e.g., encrypted and the key discarded). Sealed records are sealed because courts, prosecutors, or defense counsel decided the public and law enforcement should not access them; keeping embeddings circumvents that decision.

Revoking inference access to the sealed-record embeddings in production storage leaves the derived sealed data intact and recoverable; access revocation is not disposal and violates the seal. Sealed records belong to the case; once the model is retired, the municipal right to use the embeddings ends. Disposing of or cryptographically rendering inaccessible the sealed-record summaries destroys the wrong artifact while leaving the sealed-record embeddings intact; the seal requires destruction of the embeddings themselves, not just their outputs. Anonymizing the sealed-record embeddings with k-anonymity generalization keeps derived sealed data in use under weaker protection; generalization does not equal destruction and does not satisfy the seal's requirement for inaccessibility.

Operational check: when the case-summarization model is retired, courts IT has: (1) created a destruction certificate documenting the deletion or cryptographic destruction of all embeddings, (2) confirmed that no backup copies exist, and (3) preserved the destruction record for audit purposes.