---
id: WF-PFM-LLM-011
title: Remove an organization's AI records and content
trigger: Remove an organization’s AI rows and captured bodies.
product_area: platform
module: llm
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
  - CAP-PFM-LLM-004
crosses:
  - SVC-PFM-LLM-llm
idempotency: Each purge removes the remaining scoped batch; repeated provisioning remains not applicable.
concurrency: >-
  The participant does not lock out new requests. Correct purge sequencing depends on the workspace runner
  stopping traffic and repeating bounded steps.
hops:
  - 'n': 1
    actor_or_service: Workspace lifecycle job (Tenant Lifecycle module)
    action: Answer workspace-lifecycle purge and inventory calls; provisioning performs no AI setup.
    anchor: 'services-platform:modules/tenants/services/lifecycle/participants.ts:llmParticipant'
    seam: state_machine
    on_failure: Propagate participant failures to the lifecycle runner.
    left_inconsistent: Earlier purge batches can already be committed.
    observer: Workspace lifecycle step result and inventory.
    provenance: observed
    source: 'services-platform:modules/llm/services/maintenance/tenant-participant.ts:llmParticipant'
  - 'n': 2
    actor_or_service: LLM participant
    action: Delete scoped AI rows in dependency order using bounded batches.
    anchor: 'services-platform:modules/llm/services/maintenance/tenant-participant.ts:llmParticipant'
    seam: sync
    on_failure: Return more work or propagate failure so the runner can repeat the step.
    left_inconsistent: Some tables can be empty while later parents and object versions remain.
    observer: Workspace lifecycle step result and inventory.
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/services/maintenance/tenant-participant.integration.spec.js#removes
      the evidence only after the last row, so a surviving row never names a deleted body
  - 'n': 3
    actor_or_service: LLM participant and evidence store
    action: 'After all dependent rows are gone, delete every evidence-object version under the organization prefix.'
    anchor: 'services-platform:modules/llm/services/evidence/tenant-evidence-objects.ts:purgeTenantLlmEvidence'
    seam: sync
    on_failure: Return remaining work or fail for runner retry.
    left_inconsistent: Some body versions can remain after their rows have been removed.
    observer: Workspace lifecycle step result and inventory.
    provenance: observed
    source: 'services-platform:modules/llm/services/maintenance/tenant-participant.ts:llmParticipant'
branches:
  - The structured hops retain the applicable alternative path and its failure boundary.
waits: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/llm/services/maintenance/tenant-participant.ts;
    services/evidence/tenant-evidence-objects.ts; modules/tenants/services/lifecycle/participants.ts
    (registration, read to name it); docs/llm.md#Reading a body, and what deletes it; docs/jobs.md (durable
    jobs).
controls: [TC-AI-006, TC-AI-007, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Remove an organization's AI records and content

## What It Does

Workspace lifecycle invokes a bounded participant purge; provisioning creates no AI records.

## The Flow

```mermaid
flowchart TD
  H1["Answer workspace-lifecycle purge and inventory calls; provisioning performs no AI setup."]
  H2["Delete scoped AI rows in dependency order using bounded batches."]
  H1 --> H2
  H3["After all dependent rows are gone, delete every evidence-object version under the organization prefix."]
  H2 --> H3
```

Delete dependent rows before parents, then remove all evidence versions under the scoped prefix. Repeat while the participant reports more work.

## When Something Fails

Committed deletion batches remain after interruption. Repeating removes the remainder, but the LLM participant itself does not stop new traffic.

## Open Design Questions

Workspace orchestration must establish traffic quiescence; this participant does not prove that precondition.