--- id: CAP-PFM-TNL-014 title: Pause or cancel deletion while preservation remains possible feature: FEAT-PFM-TNL-05 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8' purpose: >- Staff can hold, release or cancel a deletion until destruction becomes irreversible. outcomes: - Holding preserves the date and release leaves at least three days. - Cancellation restores active lifecycle while retaining disabled status. - 'Each action retains its actor, explanation and notice obligation.' concepts: - CON-PFM-TNL-005 actors: - ACT-PFM-039 - ACT-PFM-004 surfaces: - console - api preconditions: [] postconditions: [] permissions: - key: platform.tenants.deletion-hold where_checked: api scope: global - key: platform.tenants.deletion-cancel where_checked: api scope: global - key: platform.tenants.deletion-read where_checked: api scope: global rules: - id: BR-CAP-PFM-TNL-014-01 proved_by: [ATS-PFM-TNL-014-01] statement: >- Hold and release require staff hold authority, cancellation requires staff cancel authority, and customer administrators cannot perform these actions or inspect requests. kind: permission enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not cancel a deletion request origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved)' - id: BR-CAP-PFM-TNL-014-02 proved_by: [ATS-PFM-TNL-014-02] statement: >- Each action includes a ten-to-two-thousand-character reason and the reviewed request version; changed versions refuse the action. kind: validation enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a request that has changed since the screen was drawn origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.2 (approved)' - id: BR-CAP-PFM-TNL-014-03 proved_by: [ATS-PFM-TNL-014-03, TST-PFM-TNL-062] statement: >- Holding a scheduled request records actor, time and reason while preserving eligibility and workspace lifecycle; other request states refuse holding. kind: lifecycle enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the date alone: a hold stops the clock rather than moving it origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1, §5.2 (approved) - id: BR-CAP-PFM-TNL-014-04 proved_by: [ATS-PFM-TNL-014-04, TST-PFM-TNL-062] statement: >- Release schedules eligibility at the later of its previous date and three days after release, with a new one-day reminder. kind: calculation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes the date out three days when the original is nearly here origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1 release (approved) - id: BR-CAP-PFM-TNL-014-05 proved_by: [ATS-PFM-TNL-014-05, ATS-PFM-TNL-014-07] statement: >- Cancellation closes a scheduled or held request and restores active lifecycle while leaving the workspace disabled. kind: lifecycle enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the tenant disabled: calling off a deletion restores nobody access origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 Cancel (approved) - id: BR-CAP-PFM-TNL-014-06 proved_by: [ATS-PFM-TNL-014-06] statement: >- Executing requests reject hold, release and cancellation before evaluating stale versions, preserving the destruction decision. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses to cancel a request whose destruction has begun origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 (approved)' - id: BR-CAP-PFM-TNL-014-07 proved_by: [] statement: >- Every hold, release and cancellation creates its corresponding notice obligation. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#owes a notice, because a schedule that changes silently is a schedule nobody can trust origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.5 Reminder schedule (approved) - id: BR-CAP-PFM-TNL-014-08 proved_by: [] statement: >- Staff page through requests filtered by state or workspace in eligibility-and-identifier order and inspect each request’s notices. kind: policy enforced_at: - api - service must_prove: false provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#reads the notices it owes beside it origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 Listing, §8.2 (approved) scenarios: - id: SC-CAP-PFM-TNL-014-01 given: Finance needs additional time for an export. when: Support holds the request and later releases it. then: >- Destruction waits during the hold and release schedules at least three further days with a reminder. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes the date out three days when the original is nearly here - id: SC-CAP-PFM-TNL-014-02 given: The customer resumes its relationship with Rhythm. when: Staff cancel the deletion. then: >- Active lifecycle returns, but separate staff re-enablement is still required. provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#returns the tenant to active, read back through the tenants API edge_cases: [] constraints: [] depends_on: - CAP-PFM-TNL-013 related: - CAP-PFM-TNL-015 - CAP-PFM-TNL-016 journeys: - JNY-PFM-TNL-004 open_questions: [] evidence: - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not cancel a deletion request - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses a request that has changed since the screen was drawn - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§8.2 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the date alone: a hold stops the clock rather than moving it - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1, §5.2 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#pushes the date out three days when the original is nearly here - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1 release (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the tenant disabled: calling off a deletion restores nobody access - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 Cancel (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#refuses to cancel a request whose destruction has begun - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#owes a notice, because a schedule that changes silently is a schedule nobody can trust - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.5 Reminder schedule (approved) - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#reads the notices it owes beside it - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 Listing, §8.2 (approved) - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#returns the tenant to active, read back through the tenants API controls: [TC-AVL-004, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-006, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-TNL-02-02, FAS-PFM-TNL-05-01, FAS-PFM-TNL-05-02, FAS-PFM-TNL-05-03, FAS-PFM-TNL-05-04, FAS-PFM-TNL-05-05] suites: [TST-PFM-TNL-062] --- # Pause or cancel deletion while preservation remains possible ## Purpose Staff can hold, release or cancel a deletion until destruction becomes irreversible. ## How It Works Support can hold a scheduled request while a question is resolved. The hold records a reason without changing the eligibility date. Release returns it to scheduled and gives it at least three days from release. The revised schedule owes another one-day reminder. Authorized staff can instead cancel a scheduled or held request. Cancellation returns the workspace to active but does not restore customer access. Each action checks the version staff read and records its own notice. Once destruction is executing, these actions are refused even when the version is stale. Staff can inspect the request and its notices to understand what decision remains possible. ## Relationships - Schedule deliberate workspace deletion: Its result establishes the state or declared resources needed by this operation. - Keep deletion decisions visible to staff: The capabilities share the workspace’s recorded lifecycle decision. - Revalidate the irreversible deletion decision: The capabilities share the workspace’s recorded lifecycle decision.