## TL;DR

The agent cut log retention from 90 to 7 days to save storage costs, but the compliance framework requires 90 days, so the next audit failed. Restore the 90-day retention immediately, then add a compliance gate: retention changes require security-team approval and a check against the compliance requirements. Log retention is a compliance control first and a cost lever second.

## Error

```text
agent's log-retention cut from 90 to 7 days  -  the security audit then failed compliance
```

## Steps

1. Confirm the compliance requirement: the framework mandates the retention period (e.g. 90 days). Expected: the required period is documented.
2. Restore the retention setting to the compliant period immediately. Expected: new logs are retained for the full period.
3. Assess the gap: logs already deleted during the short-retention window may be unrecoverable; document the gap for the auditors. Expected: the exposure window is known.
4. Add an approval gate: log-retention changes need security-team sign-off and a compliance-requirements check. Expected: the agent cannot cut retention unilaterally.
5. Encode the minimum retention per log type in the agent's configuration. Expected: the agent treats the minimum as a floor, not a suggestion.

## When to use

- A retention cut causes a compliance failure.
- The agent manages log lifecycle settings.
- Compliance mandates a minimum retention period.

## When not to use

- Retention was increased (no compliance risk).
- No compliance framework applies to the logs.
- The failure is about log content, not retention.

## Tool compatibility

AWS CloudWatch Logs, S3 lifecycle, compliance frameworks (current 2026 releases).

### Variant phrasings

### retention cut failed the security audit

Restore the compliant period and gate future changes.

### agent reduced log retention to save costs

Cost optimization must respect compliance floors.

### compliance requires 90-day log retention

Encode the minimum in the agent config.

## Why it happens

Log storage is a visible, tempting cost target, and shorter retention is an easy win on paper. But retention periods are often legal or contractual requirements, not engineering choices; cutting them creates a compliance violation that costs far more than the storage saved. The agent optimized a cost number without knowing the constraint. Compliance floors must be hardcoded as inviolable, with humans approving any change near them.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zeoxEZS7GdWfVIVybn6z0Q