---
id: ADR-PFM-SEC-006
title: Retirement boundary and forward recovery
product_area: platform
module: security
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Preserve a request-time waiting policy and gating notices, recheck protections and requester authority
  under locks at the destructive boundary, and recover partial purge by moving forward.
constrains:
- STATE-PFM-SEC-003
- WF-PFM-SEC-003
- WF-PFM-SEC-004
- SVC-PFM-SEC-tenants
- DOM-PFM-SEC-002
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#5 (thirty days chosen by Andrew 2026-10-09;
  other defaults adopted under standing order, FND-PFM-SEC-022)
alternatives:
- option: Allow immediate staff deletion.
  why_not: The planning decision requires a deliberate cancellable period before irreversible removal.
- option: Restore operational status when purge fails.
  why_not: Removed resources cannot be reconstructed by a status update, so returning partial data to use would
    hide destruction.
consequences:
- Cancellation is available only before the destructive boundary.
- Loss of requester authority places the request on hold for human decision.
- Job recovery cannot shorten eligibility or replace the decision to retire.
- The external ledger supplies deletion evidence for restored-database reapplication.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Retirement boundary and forward recovery

## Context

Retirement’s structured workflow carries the waiting and boundary rules. The ledger is a separate external effect, so a completed request without its ledger is a documented recovery gap.

The proposed policy retains its cited product origin and outstanding defaults; this examination grants no additional approval.

## Decision

Preserve a request-time waiting policy and gating notices, recheck protections and requester authority under locks at the destructive boundary, and recover partial purge by moving forward.

## Alternatives Considered

Allow immediate staff deletion. The planning decision requires a deliberate cancellable period before irreversible removal.

Restore operational status when purge fails. Removed resources cannot be reconstructed by a status update, so returning partial data to use would hide destruction.

## Consequences

Cancellation is available only before the destructive boundary.

Loss of requester authority places the request on hold for human decision.

Job recovery cannot shorten eligibility or replace the decision to retire.

The external ledger supplies deletion evidence for restored-database reapplication.