---
id: ADR-PFM-TNL-009
title: Internal Notice Obligations
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Record internal staff notice obligations and require the request notice and latest final reminder to be
  delivered or suppressed before destruction.
constrains:
- DOM-PFM-TNL-005
- STATE-PFM-TNL-005
- WF-PFM-TNL-011
- WF-PFM-TNL-012
- SVC-PFM-TNL-tenants
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.5, §13 D4 (internal-only notices, Andrew 2026-10-09)
alternatives:
- option: Notify the association
  why_not: The recorded product choice limits these messages to internal staff and the requester.
- option: Send through the Notifications module
  why_not: Moving delivery requires preserving the deletion-specific outcome gate.
- option: Exactly-once sending
  why_not: Sending and persistence cannot guarantee one external delivery; a repeat is safer than an unrecorded
    obligation.
consequences:
- Missing staff recipient configuration prevents destruction.
- Failed notice handling emits an operational signal and leaves gating obligations unsatisfied.
- These notices are not general notification-history records.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/deletion/notices/*.ts; services/deletion/notice-schedule.ts;
  aws/resources/tenant-lifecycle-notices.ssm.ts; aws/logic/tenant-deletion-notice.alarm.ts.'
---

# Internal Notice Obligations

## Context

Staff need visible notice before removal proceeds. The existing email path records outcomes independently of the general notification history.

## Decision

Record internal staff notice obligations and require the request notice and latest final reminder to be delivered or suppressed before destruction.

## Alternatives Considered

Notify the association: The recorded product choice limits these messages to internal staff and the requester. Send through the Notifications module: Moving delivery requires preserving the deletion-specific outcome gate. Exactly-once sending: Sending and persistence cannot guarantee one external delivery; a repeat is safer than an unrecorded obligation.

## Consequences

Missing staff recipient configuration prevents destruction. Failed notice handling emits an operational signal and leaves gating obligations unsatisfied. These notices are not general notification-history records.