---
id: ADR-PFM-TNL-008
title: Reversible Decisions Before Destruction
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Require a reasoned staff deletion request, fixed eligibility, reversible preservation actions and a locked
  recheck before committing irreversible removal.
constrains:
- DOM-PFM-TNL-005
- STATE-PFM-TNL-004
- SVC-PFM-TNL-tenants
- WF-PFM-TNL-009
- WF-PFM-TNL-010
- WF-PFM-TNL-011
- WF-PFM-TNL-012
- SCR-PFM-TNL-001
- SCR-PFM-TNL-003
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5, §13 D1 (thirty days), D2 (single approver),
  D3 (one day unopened), D9 (no automatic deletion) — Andrew 2026-10-09
alternatives:
- option: Immediate deletion by an authorised person
  why_not: Immediate destruction provides no chance to preserve a mistaken selection.
- option: A second approver
  why_not: The recorded product decision makes the requester the sole approver.
- option: Automatic deletion of long-disabled workspaces
  why_not: Long-disabled reporting supplies candidates without deciding deletion automatically.
consequences:
- Preservation and destruction arbitrate through the request row.
- Lost requester authority holds the request for review.
- Later settings do not recompute an existing wait; release may extend eligibility.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/deletion/{request-deletion, waiting-period, deletion-holds,
  begin-destruction}.ts.'
---

# Reversible Decisions Before Destruction

## Context

Removal has consequences that record editing cannot undo. The waiting decision and final recheck protect against mistaken selection and changed conditions.

## Decision

Require a reasoned staff deletion request, fixed eligibility, reversible preservation actions and a locked recheck before committing irreversible removal.

## Alternatives Considered

Immediate deletion by an authorised person: Immediate destruction provides no chance to preserve a mistaken selection. A second approver: The recorded product decision makes the requester the sole approver. Automatic deletion of long-disabled workspaces: Long-disabled reporting supplies candidates without deciding deletion automatically.

## Consequences

Preservation and destruction arbitrate through the request row. Lost requester authority holds the request for review. Later settings do not recompute an existing wait; release may extend eligibility.