Learn about using the session recording resource to audit user sessions. Understand how storage policy retention periods help you meet your compliance needs.
[Storage policies][] codify how long session recordings must be kept and when they should be deleted.
The resultant set of policy (RSoP) refers to the set of policy attributes that apply to a resource.
When you apply policies on multiple levels, the results can conflict.
Boundary evaluates each storage policy attribute individually, starting at the global scope and then evaluating any storage policies assigned to org scopes.
In accordance with the RSoP, Boundary considers the following principles in order:
1. Retention wins over deletion. The retention duration parameter guarantees that a session recording is retained for at least that duration. Before the retention duration has transpired, manual deletes will fail and Boundary will not attempt to automatically delete any session recordings.
2. Longest retention wins. When Boundary evaluates multiple storage policies, the longer retention duration parameter applies to the session recording.
3. The shortest deletion wins. When Boundary evaluates multiple storage policies, the shorter delete after duration parameter applies to the session recording.
Each storage policy attribute also indicates whether the attribute can be overridden or not.
If the attribute cannot be overridden, Boundary stops evaluating the RSoP for that attribute at lower scopes.
Changing the policy assigned to a scope or changing an attribute of a storage policy can impact the RSoP.
Such a change only affects future session recordings created in that scope or using that storage policy.
If a session recording is not in compliance with the current RSoP, the session recording API indicates that it is out of compliance with the current policy.
### Examples
In the following examples, Boundary determines the resultant set of policies using the `retain_for_days_overridable` and `delete_after_days_overridable` attributes.
A value of `true` indicates the number of days can be overridden, while a value of `false` indicates that it cannot be overridden.
#### Example 1
In this case, the retention value is derived from the org policy and the deletion value is derived from the global policy.
