{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-24T22:44:15.019Z",
  "record_id": "VXI-EXT-PROCUREMENT-WEAVIATE-RBAC-RESTORE-OPT-IN-01-v1",
  "record_kind": "external_reference",
  "title": "Weaviate restored data and omitted access configuration",
  "system": "Weaviate",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does restoring a Weaviate collection automatically restore its RBAC users and roles?",
  "near_questions": [
    "Why are Weaviate roles missing after a collection restore?",
    "Must usersOptions be enabled to restore Weaviate users?",
    "Does Weaviate backup success establish restored permissions?",
    "Which RBAC evidence belongs in Weaviate recovery acceptance?"
  ],
  "supported_claims": [
    {
      "claim": "The pinned backup guide states that RBAC roles and users are not restored by default. The restore options rolesOptions and usersOptions default to noRestore; selecting all enables restoration, with those options documented from v1.32.0. A data restore must therefore be reconciled separately with the intended access configuration rather than treated as proof that previous authority boundaries were recreated.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Effective access after restore and source configuration completeness were not tested.",
    "No independently verified physical deletion, complete recovery, legal compliance or security assurance.",
    "Buyer deployment testing, live runtime enforcement, certification or permission to act",
    "Expanded capabilities or licences for existing INDEX executables"
  ],
  "public_summary": "The pinned backup guide states that RBAC roles and users are not restored by default. The restore options rolesOptions and usersOptions default to noRestore; selecting all enables restoration, with those options documented from v1.32.0. A data restore must therefore be reconciled separately with the intended access configuration rather than treated as proof that previous authority boundaries were recreated.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Weaviate pinned documentation — backups",
    "source_url": "https://raw.githubusercontent.com/weaviate/docs/5dcf1d6dcd357a4cfaf613a63d052b932cd2f9c9/docs/deploy/configuration/backups.md",
    "checked_on": "2026-10-24",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-WEAVIATE-RBAC-RESTORE-OPT-IN-01-v1",
    "candidate_record_sha256": "f4124d111d71bd8df0b51941bc3fb2afedf8b48328047fb622321fc88768e789",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The pinned backup guide states that RBAC roles and users are not restored by default. The restore options rolesOptions and usersOptions default to noRestore; selecting all enables restoration, with those options documented from v1.32.0. A data restore must therefore be reconciled separately with the intended access configuration rather than treated as proof that previous authority boundaries were recreated.",
    "required_buyer_context": "Installed version and backup RBAC contents; Restore options for users and roles; Post-restore access-policy comparison. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-24",
    "claim_to_check": "Does restoring a Weaviate collection automatically restore its RBAC users and roles?",
    "documented_statement": {
      "status": "documented",
      "statement": "The pinned backup guide states that RBAC roles and users are not restored by default. The restore options rolesOptions and usersOptions default to noRestore; selecting all enables restoration, with those options documented from v1.32.0. A data restore must therefore be reconciled separately with the intended access configuration rather than treated as proof that previous authority boundaries were recreated.",
      "source_ids": [
        "weaviate-backups"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Check access configuration explicitly when accepting a restored collection. The required reconciliation is a review judgment; no buyer deployment was inspected.",
      "source_ids": [
        "weaviate-backups"
      ]
    },
    "buyer_evidence_required": [
      "Installed version and backup RBAC contents",
      "Restore options for users and roles",
      "Post-restore access-policy comparison"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Refuse access-equivalence approval from a successful data restore alone."
    },
    "unknowns": "Effective access after restore and source configuration completeness were not tested.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "Effective access after restore and source configuration completeness were not tested."
    },
    "evidence_sources": [
      {
        "source_id": "weaviate-backups",
        "url": "https://raw.githubusercontent.com/weaviate/docs/5dcf1d6dcd357a4cfaf613a63d052b932cd2f9c9/docs/deploy/configuration/backups.md",
        "final_url": "https://raw.githubusercontent.com/weaviate/docs/5dcf1d6dcd357a4cfaf613a63d052b932cd2f9c9/docs/deploy/configuration/backups.md",
        "status": 200,
        "captured_at_utc": "2026-10-24T22:28:56.379Z",
        "sha256": "16b357b8f88725baadc1bc54fa191cfd5624c6113b2a31229b336af67a271269",
        "bytes": 51417,
        "title": "Weaviate pinned documentation — backups",
        "hash_basis": "Decoded HTTP response body bytes",
        "rights_review": "Original bounded paraphrase; source bodies are captured privately and not redistributed. No repository-wide reuse licence asserted; only limited original factual paraphrase and source attribution are published.",
        "checked_on": "2026-10-24",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "Incremental backups; chained backups; retention",
          "List backups; root-only base identifier",
          "Restore configuration; RBAC limitations",
          "Cancel Restore; phase table"
        ],
        "version_context": "Pinned rolling documentation; per-feature minimum versions must remain explicit; pinned weaviate/docs revision 5dcf1d6dcd357a4cfaf613a63d052b932cd2f9c9. Source documentation is not independent evidence of buyer deployment behaviour."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Documentation review only; the buyer must establish applicability and actual outcomes. INDEX does not inspect or control the deployment.",
    "paid_value": {
      "decision_context": "Check access configuration explicitly when accepting a restored collection.",
      "free": "Complete review, sources, practical questions and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck the pinned source, deployed version, selection policy and retained operation results before relying on a current outcome."
    },
    "buyer_relevance": "Check access configuration explicitly when accepting a restored collection.",
    "refusal_conditions": [
      "Refuse access-equivalence approval from a successful data restore alone."
    ]
  },
  "niche": {
    "niche_id": "enterprise-ai-data-custody-exit-assurance",
    "label": "Enterprise AI Data Custody & Exit Assurance",
    "classification_id": "custody",
    "classification_label": "AI Data Custody, Retention & Exit Assurance",
    "topic_id": "custody",
    "buyer_intent": "Check access configuration explicitly when accepting a restored collection.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#weaviate-rbac-restore-opt-in",
  "machine_readable_record": "/varexis-index/records/weaviate-rbac-restore-opt-in.json"
}