Abstract: Newly added, deleted, or changed data of a local storage in a distributed database system is prevented from being replicated until it has been approved via a specific process. Any new, deleted, or changed records are initially marked as being candidate data. The normal replication processing within the distributed database system ignores such data. In this way, the candidate data is not allowed to leave its source site, and potentially contaminate the rest of the replication network, until that data has been approved. The approval process is provided by a candidate data scanner that detects the candidate data and provides it to a candidate data resolver for processing. The candidate data resolver is architected to provide for per installation extensibility.