---
id: WF-PFM-TNL-009
title: Request a workspace's deletion
trigger: Record a reversible staff deletion decision with fixed eligibility and a watcher.
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
design_intent: confirmed
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1–§5.3, §5.7, §13 D1–D3 (approved 2026-10-09;
  Andrew 2026-10-09)
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
- CAP-PFM-TNL-013
- CAP-PFM-TNL-015
moves:
- STATE-PFM-TNL-001
- STATE-PFM-TNL-004
- STATE-PFM-TNL-005
crosses:
- SVC-PFM-TNL-tenants
idempotency: The open-request unique index prevents a second open decision. The watcher submission key is derived
  from its request.
concurrency: The request transaction locks the workspace while deciding admission and recording pending deletion.
hops:
- n: 1
  actor_or_service: Platform API (requestTenantDeletion)
  action: Authorize the staff deletion-request operation.
  anchor: services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:requestTenantDeletion
  seam: sync
  on_failure: Refuse customer or unauthorized callers.
  left_inconsistent: No deletion decision is recorded.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts
- n: 2
  actor_or_service: Deletion request
  action: Lock and validate exact name, reason, reviewed version, disabled standing, admitted lifecycle, childlessness
    and protection.
  anchor: services-platform:modules/tenants/services/deletion/request-deletion.ts:assertDeletable
  seam: sync
  on_failure: Return the applicable selection or standing refusal.
  left_inconsistent: The workspace is not moved to pending deletion.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/request-deletion.ts:requestTenantDeletion
- n: 3
  actor_or_service: Waiting period
  action: Fix eligibility from disposable policy, missing activation history or configured day wait.
  anchor: services-platform:modules/tenants/services/deletion/waiting-period.ts:tenantDeletionWaitingPeriod
  seam: sync
  on_failure: Reject inadmissible disposable choices and invalid settings.
  left_inconsistent: No waiting decision is stored.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/waiting-period.ts
- n: 4
  actor_or_service: Deletion request
  action: Commit copied decision identity, actor, reason, customer choice, notice obligations, watcher and pending-deletion
    lifecycle.
  anchor: services-platform:modules/tenants/services/deletion/request-deletion.ts:requestTenantDeletion
  seam: sync
  on_failure: Roll back the entire request transaction.
  left_inconsistent: All request records commit together or none.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/notice-schedule.ts:noticesForNewRequest
- n: 5
  actor_or_service: Deletion request
  action: Clear local availability facts and start the watcher after commit.
  anchor: services-platform:modules/tenants/services/deletion/request-deletion.ts:startTenantDeletionSchedule
  seam: state_machine
  on_failure: Return the recorded request despite a logged start failure.
  left_inconsistent: The request can wait without notice delivery until schedule recovery.
  observer: Job progress and service logs.
  provenance: observed
  source: services-platform:modules/tenants/services/deletion/request-deletion.ts:startTenantDeletionSchedule
branches:
- Disposable override minutes cannot exceed the configured disposable wait.
- The decision can request removal of a final customer.
waits: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/deletion/{request-deletion, waiting-period, notice-schedule}.ts;
  aws/api/tenant-deletion-requests.routes.ts; db/tenant-deletion-requests.table.ts.'
controls: [TC-AVL-001, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Request A Workspace'S Deletion

## What It Does

Record a reversible staff deletion decision with fixed eligibility and a watcher. The open-request unique index prevents a second open decision. The watcher submission key is derived from its request.

## The Flow

```mermaid
sequenceDiagram
  autonumber
  actor Staff as Rhythm staff
  participant API as Platform staff route
  participant Req as Deletion request
  participant DB as Platform database
  participant Jobs as Watcher (Step Functions)
  Staff->>API: request deletion (name, reason)
  API->>Req: validate
  Req->>DB: lock workspace, check every safeguard
  Req->>Req: fix the waiting period
  Req->>DB: request, notices, watcher job, workspace pending deletion (one commit)
  Req->>Jobs: start watcher after commit
  Req-->>Staff: request with its eligibility date
```

## When Something Fails

Refuse customer or unauthorized callers. No deletion decision is recorded. Return the applicable selection or standing refusal. The workspace is not moved to pending deletion. Reject inadmissible disposable choices and invalid settings. No waiting decision is stored. Roll back the entire request transaction. All request records commit together or none. Return the recorded request despite a logged start failure. The request can wait without notice delivery until schedule recovery.

## Open Design Questions

Loading cannot enter the current request path despite its allowed successor. Deletion and reset use different selection-confirmation text.