Abstract
A revision history can preserve the part of publishing that a finished book conceals. It may show a co-writer proposing a paragraph, an editor resisting a claim, a sensitivity reader naming a risk, a copyeditor catching a harmful assumption, or a team struggling to decide whose account of an event belongs on the page. That evidence can matter. It can also expose people who never expected their abandoned wording, professional hesitation, private correspondence, or uncredited labor to become readable decades later.
This paper treats that tension as a stewardship question rather than a storage preference. Revision record stewardship is the active, time-bound duty to decide how a trace of change will be kept, restricted, contextualized, transferred, transformed for access, or removed in relation to the people it may expose, the evidence it preserves, and the copies that may already exist. A revision record may include tracked changes, comments, version exports, draft files, editorial messages, review notes, and histories generated by a writing system. The point is not that every trace deserves archival treatment. The point is that consequential traces should not be governed by two reflexes: keep everything because archives matter or delete everything because drafts are private.
Drawing on archival appraisal and ethics, special-collections privacy practice, public-record redaction guidance, version-history documentation, a scholarly digital-edition case, and de-identification guidance, the paper introduces the Revision Record Stewardship Protocol. The instrument enables a writer, editor, archive worker, publisher, or team to name the record at issue; the people implicated; its evidential value; foreseeable exposure; access level; retention horizon; proposed action; and review trigger. It does not deliver legal advice, establish a retention schedule, decide an individual’s privacy interest, guarantee anonymization, or promise that deletion will remove distributed copies. It teaches a smaller but crucial practice: make the fate of a revision record a reasoned, documented, revisable decision. [1] [2] [3]
Working principle: Preserve neither by inertia nor disclose by default. Decide what trace is at stake, whose exposure it carries, what value would be lost, what scope the steward controls, and when the decision must be revisited.
1. The recovered history that reveals too much
Consider an explicitly constructed estate deposit. A novelist has died. In a folder transferred to a repository are an early chapter, a co-writer’s margin comments, a sensitivity reader’s tracked changes, an editor’s message asking whether a scene identifies a real person, and an exported revision history from the shared draft. The published novel credits the novelist alone. A researcher wants the entire folder because it reveals that the book did not emerge from one person’s solitary inspiration. The estate agrees that some evidence of the process should survive. It does not want every discarded exchange opened to general reading, especially where living people, confidential professional work, and abandoned personal material may be visible.
The tension cannot be solved merely by calling the folder a personal archive. The term identifies a potential value; it does not identify an access condition. Nor does the fact that an exchange was deleted from the published book settle its fate. A deleted phrase may be trivial residue, sensitive personal material, evidence of a contributor’s labor, a record of a harmful editorial decision, or something else entirely. Its future use depends on a situation rather than its format.
The central question is therefore not, “Should the archive keep the revision history?” It is more demanding:
Does the research value of a revision record entitle later readers to unrestricted exposure of every person whose trace appears inside it?
The answer cannot be a general yes. Value and exposure are distinct questions. A record can have substantial research value and require delayed or mediated access. A record can raise a serious exposure concern and still be unsuitable for immediate destruction. A record can justify an access derivative while the original stays controlled. A steward can decide that a trace is no longer needed within the records under their control while admitting that identical or related copies may remain elsewhere.
The estate packet is a teaching case, not an instruction about any author, archive, contributor, or legal regime. Its value lies in the decision it makes visible. The folder holds several kinds of evidence, implicates several kinds of people, and invites several kinds of future use. A responsible response must make those differences legible.
2. Revision record stewardship is a decision, not a storage setting
A revision record is any surviving trace that enables a person to see or infer textual change, editorial relationship, review, sequence, or intervention. It may be visible—such as a marked typescript or a comment in a document—or less visible—such as a prior file export, a revision log, embedded metadata, an audit trail, or a repository commit. Not every working save needs a disposition conference. But when a trace may be deposited, transferred, published, cited, released, requested, or deleted, its stewardship becomes an active choice.
The U.S. National Archives and Records Administration defines appraisal as the process of determining a record’s value and final disposition, temporary or permanent.[1] Its policy stresses that appraisal is not a rote exercise and identifies questions about research value, source and context, uniqueness, usability, relationship to other records, cost, volume, and reappraisal.[1] That policy governs U.S. federal records, not private papers or publishing teams. Still, it supplies a useful discipline: retention is a justified conclusion, not the natural consequence of having storage.
The Society of American Archivists’ core values and ethics make the tension more explicit. The statement urges archivists to provide broad access while respecting legal and ethical access restrictions, privacy, donor commitments, and cultural protections.[4] It also describes records as evidence through which people and organizations can be held accountable, and asks archivists to document their interventions, restrictions, processing actions, and stewardship decisions.[4] This is not a formula that tells an estate what to do. It is a reminder that access, privacy, accountability, capacity, and transparency can all be legitimate values without being identical values.
A storage setting is usually passive: a folder is synchronized, a file is marked private, a server keeps prior versions, a box is accessioned. Stewardship is active. It asks five questions:
| Stewardship question | What it prevents |
|---|---|
| What trace or copies are actually being decided about? | A promise to delete or retain “the history” when only one export or one storage location is controlled. |
| Who is implicated? | Treating the nominal author as the only person with a stake in a record that contains editors, reviewers, subjects, or uncredited collaborators. |
| What evidence could be lost? | Treating all private material as residue, even when it documents labor, decision-making, or institutional conduct. |
| What exposure could follow? | Treating all archival value as a right of immediate public reading. |
| When and by whom will the decision be reviewed? | Turning a temporary restriction, an operational deletion, or an uncertain disposition into unexplained permanence. |
The framework does not confer authority over another person’s materials. It makes a decision’s assumptions inspectable. A steward may still need contracts, donor terms, local policy, applicable law, or counsel. The Protocol begins before those systems: it makes clear what question needs their attention.
3. Four actions, not two
When a revision trace feels difficult, the familiar choices are too blunt: keep it or delete it. Stewardship offers at least four distinct actions. They can be combined, sequenced, or revised. None is morally pure.
| Action | What the action does | What it does not establish |
|---|---|---|
| Retain with access | Keeps a stated record and permits a defined audience to consult it. | That every person mentioned consented, every statement is true, or every future use is appropriate. |
| Retain with restriction | Keeps a record while delaying or limiting access under a documented condition. | That the restriction is invisible, permanent, cost-free, or self-executing. |
| Retain original; create a transformed access derivative | Preserves a controlled original while creating a redacted, excerpted, summarized, or otherwise bounded representation for a stated use. | That removal prevents contextual inference, that the derivative carries every evidential property of the original, or that the original no longer needs care. |
| Dispose or delete within stated scope | Removes a record from a specified controlled location or process under a documented basis. | That other shared, backed-up, printed, transferred, or externally held copies have been removed. |
The National Archives of the United Kingdom’s Redaction Toolkit demonstrates why the third action deserves to be separate. The guidance defines redaction as separating disclosable from non-disclosable information before release and directs reviewers to redact a copy rather than the original record.[2] It also emphasizes recording the identifier, material removed, rationale, review information, and the condition that led to a restriction.[2] The toolkit applies to public bodies and public-record access. It is not a general legal instruction for literary archives. Yet it captures a stewardship distinction that transfers cautiously: preservation of an original and release of an access representation are different operations.
That difference matters in born-digital work. The UK guidance warns that office formats may contain change histories, audit trails, or embedded metadata that can expose information not apparent in the visible display.[2] A black rectangle in a file is not necessarily a secure access derivative. A renamed document is not necessarily a new evidentiary object. A clean PDF may leave behind a history in its source file. The practical lesson is not that every editor needs a forensic workflow. It is that a steward should name which version has been retained, which version is being released, and what the transformation can and cannot protect.
Zachary Stein’s case study of personally identifiable information in a university special-collections setting shows the same distinction in physical materials. The study describes the tension between access and privacy, the difficulty of screening large collections, and a practice in which restricted folders may later be revisited for redaction, reprocessing, or deaccessioning.[3] It also describes a process that retains a restricted original while placing an access copy into a collection.[3] The case is limited: it is one institution, mostly physical records, and a resource-constrained backlog. It does not tell every archive how long to close a folder. It demonstrates instead that restriction can be a temporary stewardship condition with a review pathway, not a euphemism for doing nothing.
The fourth action—disposition—needs equally careful language. Pro Git explains that local commit history can be amended, reordered, squashed, split, or have commits dropped, but warns that rewriting shared history creates alternate versions and can confuse collaborators.[5] The technical details belong to Git, not to every writing system. The analogy is modest: the scope of a deletion decision matters. Removing an export from one person’s local folder does not determine what remains on a colleague’s device, a hosted service, a backup, a printed packet, an email attachment, or an archive transfer. A Protocol should never record simply “deleted.” It should record deleted from which controlled location, under what authority, with what knowledge of already-distributed copies.
4. One estate packet, four different exposure conditions
Return to the constructed estate deposit. It would be a mistake to give all its contents the same disposition merely because they are “draft material.” The items expose different people, carry different evidence, and create different practical questions.
| Packet component | Possible evidential value | Exposure condition | Stewardship question |
|---|---|---|---|
| Early chapter with a deleted personal scene | Can reveal compositional development or the treatment of a subject. | May involve a living person, an intimate experience, or a recognizable place. | Is original retention useful enough to justify a restriction, and what access condition would avoid treating publication as automatic? |
| Co-writer comments | Can make uncredited labor, disagreement, and distribution of creative work visible. | May disclose an employment relationship, negotiation, private criticism, or a contributor who did not expect public attribution. | Could the original be restricted while a contextual note, a consent-based release, or later review is considered? |
| Sensitivity reader tracked changes | Can document an intervention, a concern, and the influence of specialized reading. | May disclose identity, professional expertise, a confidential brief, or a sensitive subject position. | Is an unedited record needed for accountability, and if so, who should be able to consult it and under what condition? |
| Revision-history export | Can show sequence, contribution, and change over time. | May include names, timestamps, embedded metadata, deleted text, and traces copied across systems. | What stores or copies fall inside the steward’s control, and which records persist outside it? |
The value of the co-writer’s comments does not arise merely from the words. It may arise because a published book gives a different public account of how the work was made. The record can matter precisely because it resists a solitary-author story. That does not give a future reader an automatic claim to every private exchange. A protocol can identify the labor value and the exposure condition at the same time.
The sensitivity reader’s changes make the tension sharper. Suppose the comments document a recommendation that altered a harmful characterization. That may be consequential evidence of editorial labor. The comment thread may also contain personal experiences, contractual details, or a name that permits a reader to infer professional relationships. “Keep” is incomplete because it omits access. “Redact” is incomplete because it omits what is preserved, what is released, whether the redaction can be inferred, and whether a substituted text still accurately represents the intervention.
The estate packet therefore demands different, reasoned responses. It does not invite a hierarchy in which historical interest always wins. It asks the steward to see that a revision history can be a distributed record: a single visible manuscript may contain several people’s traces, while the same interaction may survive in several technical forms.
5. The Revision Record Stewardship Protocol
The Revision Record Stewardship Protocol is a decision sheet for consequential revision traces. It does not replace an institutional retention schedule, a deed of gift, a contract, or relevant legal expertise. It prevents a common failure before those systems are consulted: treating one person’s desire, one filename, or one platform setting as the full account of the record.
| Protocol field | Reader records | Decision value |
|---|---|---|
| 1. Record and scope | The trace being decided about; original, copy, export, derivative, or grouped set; known stores and distribution. | Stops a disposition claim from exceeding the record or copies actually controlled. |
| 2. People implicated | Creator, editor, co-writer, reviewer, subject, contributor, repository, and known people without a role in the later record’s disposition. | Makes exposure relational rather than treating the nominal author as the sole affected person. |
| 3. Evidential value | What process, labor, decision, disagreement, relationship, or accountability question the trace may illuminate. | Distinguishes value from automatic public access. |
| 4. Sensitivity and exposure | Direct or indirect identifiers, confidential exchange, contextual inference, vulnerable person, professional risk, reputational concern, or unresolved policy/legal question. | Requires a stated exposure assessment rather than a vague “private” designation. |
| 5. Access level | Open, mediated, named-researcher, embargoed, staff only, contributor-consultation required, or no access. | Separates retention from release and names who may use the record. |
| 6. Retention horizon | Permanent, fixed term, until a stated event, pending decision, or short operational period. | Replaces presumed permanence with a time-bound condition. |
| 7. Preservation or disposition action | Retain, transfer, restrict, create access derivative, retain source in controlled custody, quarantine, delete within control, or a combination. | Connects the action to the particular representation and scope. |
| 8. Review trigger and rationale | Date, event, responsible role, decision source, uncertainty, and what would justify re-examination. | Creates accountability for the decision and a path for future change. |
Here is a worked teaching example for the sensitivity reader’s tracked changes. The result is not a universal answer; it models the kind of answer a steward must make explicit.
| Field | Example entry for a constructed teaching case |
|---|---|
| Record and scope | Original DOCX with tracked changes and comments; one exported PDF; known copy in the estate’s working drive. Other prior recipients and backups are not verified. |
| People implicated | Novelist, named sensitivity reader, editor, any person described in comments, estate, and future readers. |
| Evidential value | May document a specific editorial intervention and otherwise uncredited reading labor affecting the published text. |
| Sensitivity and exposure | Direct identity, professional advice, discussion of a real-person reference, and potentially confidential contextual information. |
| Access level | Restricted to a named research purpose and mediated by the repository; no open online release at the initial decision point. |
| Retention horizon | Retain original pending review; access condition reviewed after five years or if contributor consultation changes the context. |
| Preservation/disposition action | Preserve the original in controlled custody; create no public derivative until a specific exposure assessment determines whether a contextual summary or redacted derivative can accurately serve the intended research use. |
| Review trigger and rationale | Review at stated date, on contributor communication, on a donor/institutional policy change, or when a documented research question requires reconsideration. Record that the decision recognizes evidence of intervention but does not equate it with public entitlement. |
The specific five-year period is not the lesson. A different case could justify a shorter operational period, a longer embargo, an immediate consent-based release, or disposition after a limited function has been served. The lesson is that the record, the people, the evidence, the exposure, the action, and the review condition must all appear in the same decision.
This field structure also disciplines the use of anonymization. NIST advises organizations considering de-identification to evaluate their purpose, possible disclosure risks, and sharing model rather than assuming that masking is sufficient.[6] The Information Commissioner’s Office similarly explains that effective anonymization requires a person not to be identifiable directly or indirectly, including by combination with other information, and distinguishes anonymization from pseudonymization, which can leave personal data linkable through additional information.[7] Both sources address datasets and regulatory contexts, not literary drafts. Their narrow implication for revision records is still important: replacing a name may not make a free-form narrative safe to release. Distinctive events, roles, locations, writing style, and contextual clues may permit inference.
For that reason, the Protocol says create a transformed access derivative rather than simply anonymize. A derivative may take the form of a redacted copy, a controlled excerpt, a summary of a documented intervention, a contribution note, or a mediated consultation. Each has different evidential losses and different exposure risks. Calling them all anonymization hides the decision readers need to inspect.
6. The counterpoint: forgetting can erase labor; preservation can expose it
A right to forget drafts is a useful ethical intuition when it prevents casual exposure of vulnerable people, unfinished thought, or private exchanges. It becomes dangerous when used as an unexamined instruction to erase all traces of how a work was made. Destruction can remove evidence of a co-writer’s contribution, a community reader’s warning, an editor’s refusal, an institution’s decision, or an author’s change of mind. In some cases, it can make an official, simplified narrative appear more complete than it is.
The SAA ethics statement identifies archival records as a means by which decision-making, power imbalance, and accountability can become visible.[4] It also asks archivists to be transparent about selection, retention, and intervention decisions.[4] This is a warning against destructive forgetting, not a command for immediate publication. Accountability can be served by retaining a restricted original, documenting a redaction decision, preserving a contribution record, or creating a mediated path for specific research. The access condition remains part of the ethical analysis.
The Walt Whitman Archive gives a historically distant example of why process traces can matter. Its editorial policy describes materials surviving as manuscripts, notebooks, marginalia, periodicals, and books; marks additions, deletions, transpositions, gaps, and uncertain readings; and documents the work of staff members and senior editors who transcribe, review, date, relate, and approve records for public presentation.[8] The Archive explicitly frames its work as documentary rather than an attempt to reconstruct a presumed authorial intention, and acknowledges that many editorial relationships remain uncertain or incomplete.[8]
The example has strict limits. A public scholarly edition of a nineteenth-century author is not a model for releasing living collaborators’ confidential exchanges. Its value lies elsewhere. It shows that revisions can reveal multiple agents, decision-making, and layers of care that a finished text obscures. The responsible inference is not “publish process.” It is: do not let a convenient decision about privacy or deletion hide whose labor, voice, or interest is being affected.
That is why the Protocol’s rationale field matters. A steward may choose restriction because a contributor’s privacy requires it. They may choose retention because the record carries significant evidence. They may create an access derivative because it preserves some research value while reducing exposure. They may dispose of a redundant operational record because its value is low and its retention risk is unjustified. In each case, the document should record that this was a decision—not a neutral outcome of storage capacity, a default platform setting, or an inherited habit.
7. Scope and review: no magic exit
Two comforting verbs cause repeated problems in revision stewardship: delete and anonymize. Both can describe real actions. Neither is a complete account of the action’s effect.
The Git example makes scope visible. A person can alter or drop a record in a local Git history, but the documentation warns that rewriting commits after sharing changes the situation because collaborators may hold alternate versions.[5] Draft systems differ in their technical behavior, and the paper does not make Git a model for all of them. The broader stewardship point is simply that deletion needs a location and a boundary. “Deleted from the author’s local drive” is a more truthful statement than “deleted,” when comments may remain in email, backups, shared drives, printed copies, or a collaborator’s account.
Anonymization also needs a condition, not an assumption. NIST notes that de-identification may reduce disclosure risk but requires an assessment of purpose, release model, and residual risk.[6] ICO guidance warns that a person may remain identifiable through combinations of information and that pseudonymization does not remove the link to a person when additional information can restore it.[7] Applied cautiously to revision records, this means a changed name or removed email address may reduce an immediate exposure while leaving a distinctive story, role, date, or context readable enough to identify someone.
Before settling a consequential disposition, ask four final questions:
- What original, copies, exports, and repositories do we actually control?
- Whose trace or exposure is inside the record, including people not credited on the published work?
- What research, labor, or accountability value would immediate destruction remove, and what harm could access create?
- What event, date, evidence, or authority will cause this decision to be reviewed?
The Protocol does not eliminate hard choices. It makes them visible. Revision record stewardship begins when a person stops asking whether drafts are simply private or simply valuable and starts making a documented, proportionate, revisable decision about what a particular record can become.
References
[1] U.S. National Archives and Records Administration. “Appraisal Policy of the National Archives.” 20 September 2007. https://www.archives.gov/records-mgmt/scheduling/appraisal
[2] The National Archives (United Kingdom). “Redaction Toolkit.” https://www.nationalarchives.gov.uk/terms-and-conditions/takedown-and-reclosure-policies/reclosure-policy/redaction-toolkit/
[3] Stein, Zachary G. “Privacy in Public Archives: Managing Personally Identifiable Information in Special Collections.” RBM: A Journal of Rare Books, Manuscripts, and Cultural Heritage 22, no. 1 (2021): 29–45. https://rbm.acrl.org/index.php/rbm/article/view/25216/33088
[4] Society of American Archivists. “SAA Core Values Statement and Code of Ethics.” Revised August 2025. https://www2.archivists.org/statements/saa-core-values-statement-and-code-of-ethics
[5] Pro Git. “7.6 Git Tools — Rewriting History.” Git project documentation. https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History
[6] National Institute of Standards and Technology. SP 800-188: De-Identifying Government Datasets. 2023. https://csrc.nist.gov/pubs/sp/800/188/final
[7] Information Commissioner’s Office. “Introduction to Anonymisation.” https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/
[8] Walt Whitman Archive. “Editorial Policy Statement and Procedures.” https://whitmanarchive.org/about/editorial-policies