---
id: CAP-PFM-SEC-004
title: Manage a workspace retirement request
feature: FEAT-PFM-SEC-01
product_area: platform
module: security
revision: 1
status: draft
product_intent: proposed
implementation_evidence: observed
supersedes: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
intent_sources:
  - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5. Deletion'
  - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#13 (D1, D2, D3, D4)'
  - >-
    services-platform:docs/tenants/tenant-lifecycle-plan.md#Acceptance checkpoints (2026-10-10 Final
    acceptance)
purpose: >-
  Rhythm staff schedule and oversee workspace removal with a waiting period, delivered notices and a
  clear boundary after which cancellation is unavailable.
outcomes:
  - 'Staff can review, hold or cancel a pending retirement.'
  - The start of destruction rechecks current safety conditions.
  - A retained request explains the removal after the workspace is gone.
concepts:
  - CON-PFM-SEC-002
actors:
  - ACT-PFM-004
  - ACT-PFM-005
  - ACT-PFM-006
surfaces:
  - api
  - job
preconditions: []
postconditions: []
permissions:
  - key: platform.tenants.deletion-request
    where_checked: api
    scope: global
  - key: platform.tenants.deletion-hold
    where_checked: api
    scope: global
  - key: platform.tenants.deletion-cancel
    where_checked: api
    scope: global
  - key: platform.tenants.deletion-read
    where_checked: api
    scope: global
rules:
  - id: BR-CAP-PFM-SEC-004-01
    proved_by: [ATS-PFM-SEC-004-01, TST-PFM-SEC-224, TST-PFM-SEC-225]
    statement: >-
      Deletion requests and their hold, release, cancellation, read and recovery actions each require
      staff permission; customer administrators cannot perform them, and no immediate-delete action is
      available.
    kind: permission
    enforced_at:
      - api
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not ask for a
      tenant to be deleted
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#13 (D2)'
  - id: BR-CAP-PFM-SEC-004-02
    proved_by: [ATS-PFM-SEC-003-22, ATS-PFM-SEC-004-02, ATS-PFM-SEC-004-12, ATS-PFM-SEC-004-13, ATS-PFM-SEC-004-26, TST-PFM-SEC-225, TST-PFM-SEC-237]
    statement: >-
      Requesting deletion requires disabled status, active or failed-provisioning lifecycle, no lock or
      sandboxes, a workspace outside the protected development set, exact name confirmation, a
      10–2,000-character reason and the version read.
    kind: validation
    enforced_at:
      - api
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses
      a tenant that is still live, because people must lose access first
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.2 Who may do what'
  - id: BR-CAP-PFM-SEC-004-03
    proved_by: [ATS-PFM-SEC-004-03, TST-PFM-SEC-237, TST-PFM-SEC-245]
    statement: >-
      Only one open deletion request may exist per workspace; cancellation permits a later request with a
      new identity and waiting period.
    kind: invariant
    enforced_at:
      - service
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses
      a second request, naming the one that is open
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.7 Duplicate, stale and repeated requests'
  - id: BR-CAP-PFM-SEC-004-04
    proved_by: [ATS-PFM-SEC-004-04, TST-PFM-SEC-237]
    statement: >-
      The request fixes its eligibility date using the workspace calendar: normally thirty days, one day
      if never activated, and minutes only for disposable non-production workspaces; production
      configuration below fourteen days is refused.
    kind: calculation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#fixes
      the date destruction may begin, thirty days on by the calendar of the tenant zone
    origin: none
  - id: BR-CAP-PFM-SEC-004-05
    proved_by: [ATS-PFM-SEC-004-05, TST-PFM-SEC-235, TST-PFM-SEC-238, TST-PFM-SEC-245]
    statement: >-
      Staff notices accompany request creation, reminders, holds, releases, cancellation, destruction and
      outcomes; destruction requires delivery of the request notice and one-day reminder and keeps
      waiting when delivery fails.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js#holds
      the deletion indefinitely when a notice could not be delivered, rather than destroying the tenant
      unannounced
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#13 (D4)'
  - id: BR-CAP-PFM-SEC-004-06
    proved_by: [ATS-PFM-SEC-004-06, ATS-PFM-SEC-004-17, ATS-PFM-SEC-004-18, TST-PFM-SEC-236]
    statement: >-
      A reasoned hold blocks progress without changing the eligibility date; release within three days of
      eligibility or after it gives a further three days and schedules another one-day reminder.
    kind: calculation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes
      the date out three days when the original is nearly here
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.1 The lifecycle'
  - id: BR-CAP-PFM-SEC-004-07
    proved_by: [ATS-PFM-SEC-002-23, ATS-PFM-SEC-004-07, ATS-PFM-SEC-004-14, ATS-PFM-SEC-004-19, ATS-PFM-SEC-004-20, ATS-PFM-SEC-004-25, TST-PFM-SEC-236]
    statement: >-
      Cancellation before destruction restores active lifecycle but preserves disabled status;
      cancellation after destruction starts fails.
    kind: lifecycle
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves
      the tenant disabled: calling off a deletion restores nobody access
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.4 Cancellation and the point of no return'
  - id: BR-CAP-PFM-SEC-004-08
    proved_by: [ATS-PFM-SEC-004-08, ATS-PFM-SEC-004-15, ATS-PFM-SEC-004-21, TST-PFM-SEC-235]
    statement: >-
      Destruction rechecks eligibility, gating notices, request state, disabled status, absence of locks
      and sandboxes and the requester’s current authority; lost requester authority puts the request on
      hold.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#holds
      the request in that case, so a person has to look at it rather than a job retrying forever
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.4 Cancellation and the point of no return'
  - id: BR-CAP-PFM-SEC-004-09
    proved_by: [ATS-PFM-SEC-004-09, TST-PFM-SEC-235]
    statement: >-
      Concurrent cancellation and destruction serialize so that one outcome wins without leaving
      partially updated lifecycle state.
    kind: invariant
    enforced_at:
      - service
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses
      the cancel as already executing in every round destruction won
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#Acceptance criteria (4)'
  - id: BR-CAP-PFM-SEC-004-10
    proved_by: [ATS-PFM-SEC-004-10, ATS-PFM-SEC-004-16, ATS-PFM-SEC-004-22, ATS-PFM-SEC-004-23, TST-PFM-SEC-224]
    statement: >-
      Recovery can restart a stopped schedule without advancing eligibility and can restart purge only
      after purge failure.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#leaves the request
      scheduled, and its eligibility exactly where it was: a resume cannot bring a deletion forward
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.8 Operators'
  - id: BR-CAP-PFM-SEC-004-11
    proved_by: [ATS-PFM-SEC-004-11, ATS-PFM-SEC-004-24, TST-PFM-SEC-237, TST-PFM-SEC-240]
    statement: >-
      The deletion request retains workspace and customer identity, actors, reasons and removal counts
      after workspace removal, and the retired workspace identifier remains unavailable for reuse.
    kind: invariant
    enforced_at:
      - service
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#copies
      the tenant name and customer, so the record still reads after the tenant is gone
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.10 What remains after deletion'
  - id: BR-CAP-PFM-SEC-004-12
    proved_by: []
    statement: >-
      Staff can page through requests by state or workspace, inspect notices and progress, and receive no
      more than 100 requests per page.
    kind: policy
    enforced_at:
      - api
      - service
    must_prove: false
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#reads the notices
      it owes beside it
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.8 Operators'
  - id: BR-CAP-PFM-SEC-004-13
    proved_by: []
    statement: >-
      The product should add a reasoned security-audit event for deletion recovery; the inspected
      recovery path does not currently write that event.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: unknown
    source: FND-PFM-SEC-011
    origin: none
scenarios:
  - id: SC-CAP-PFM-SEC-004-01
    given: A previously used training workspace is disabled.
    when: An authorized Rhythm Administrator requests removal with the exact workspace name and a reason.
    then: >-
      The request becomes eligible after the thirty-day wait, moves lifecycle to pending deletion and
      schedules staff notification.
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#answers the
      thirty-day waiting period
  - id: SC-CAP-PFM-SEC-004-02
    given: The customer asks staff to stop a scheduled retirement.
    when: Support holds the request and an authorized administrator cancels it.
    then: Lifecycle returns to active while disabled status remains until a separate re-enabling decision.
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#leaves the tenant
      disabled: calling off a deletion restores nobody access
edge_cases: []
constraints: []
depends_on: []
related:
  - CAP-PFM-SEC-002
  - CAP-PFM-SEC-003
journeys: []
open_questions:
  - OQ-PFM-SEC-001
evidence:
  - >-
    Pinned services-platform references for the structured rows: docs/tenants/tenant-lifecycle-plan.md;
    modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js;
    modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js;
    modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js;
    modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js;
    modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js;
    modules/tenants/tests/integration/services/deletion/tenant-deletion-schedule.integration.spec.js.
controls: [TC-AVL-001, TC-AVL-004, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-003, TC-DAT-004, TC-DAT-006, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
exercised_by: [FAS-PFM-SEC-01-03, FAS-PFM-SEC-01-04, FAS-PFM-SEC-01-05]
suites: [TST-PFM-SEC-224, TST-PFM-SEC-225, TST-PFM-SEC-235, TST-PFM-SEC-236, TST-PFM-SEC-237, TST-PFM-SEC-238, TST-PFM-SEC-240, TST-PFM-SEC-245]
---
# Manage a workspace retirement request

## Purpose

Staff retire an association’s workspace through a reviewable request. The request gives staff a chance to stop removal and preserves an explanation after the customer’s live records are gone.

## How It Works

An authorized staff member prepares the disabled workspace and submits a retirement request. The request page or API response provides the schedule and reasons staff need for follow-up. Staff review notices and progress while the waiting period runs. Support can hold the request when a commercial or operational question needs attention. Releasing a hold resumes scheduling under the release rule. Cancellation ends the request without deciding whether the association should regain access. When destruction becomes eligible, the platform evaluates the current safeguards before creating purge work. A failed schedule or purge appears as recovery work for operators. Recovery continues the existing retirement rather than accelerating its date. The retained request supplies the record staff can consult after removal; audit coverage for recovery remains a documented gap.

## Relationships

- Workspace administration supplies disabled status and the current version.
- The cross-service lifecycle module defines how participants remove their records.
- Operations supplies durable schedules, purge execution and job progress.