---
id: ADR-PFM-SEC-003
title: Permanent readable customer and workspace identity
product_area: platform
module: security
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Use creator-selected readable identifiers for customers and workspaces, preserve them through edits,
  and retire workspace identifiers after deletion.
constrains:
- DOM-PFM-SEC-001
- DOM-PFM-SEC-002
- SVC-PFM-SEC-customers
- SVC-PFM-SEC-tenants
- SCR-PFM-SEC-024
- SCR-PFM-SEC-028
origin: 'Andrew, 2026-10-17: migrated workspaces keep their Rhythm 1.0 identifiers (services-platform:docs/proposals/tenant-identity.md);
  migration 20261017164245_tenant_identity'
alternatives:
- option: Generate server identifiers and store a second readable domain name.
  why_not: The recorded reversal preserves migrated file locations and avoids competing identities for the
    same workspace.
consequences:
- Provisioning rejects malformed, reserved, occupied and generated-shaped identifiers.
- Deletion permanently retires workspace identifiers so existing references cannot identify another association.
- A customer and workspace may use the same readable value while remaining distinct records.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Permanent readable customer and workspace identity

## Context

The cited product decision settled readable identity and migration continuity. This record carries that decision into the domain and service contracts; it does not seek a new identity decision.

The grammar and enforcement details live in the structured object invariants.

## Decision

Use creator-selected readable identifiers for customers and workspaces, preserve them through edits, and retire workspace identifiers after deletion.

## Alternatives Considered

Generate server identifiers and store a second readable domain name. The recorded reversal preserves migrated file locations and avoids competing identities for the same workspace.

## Consequences

Provisioning rejects malformed, reserved, occupied and generated-shaped identifiers.

Deletion permanently retires workspace identifiers so existing references cannot identify another association.

A customer and workspace may use the same readable value while remaining distinct records.