MAP · CONTROL · RECONCILE
Tenant offboarding: stop late writes
Follow actual fictional records through primary storage, a backup, an export and a restore.
Scroll the diagram left or right to inspect all three copies. The panels below give the same state as text.
Your experiment
Compare subject deletion with tenant offboarding. The latter removes the wider authorized scope and blocks a late write. Inspect held records and pending backup copies before calling the workflow finished.
Play takes one minute at 1×. Pause, step or scrub the computed history. Input changes reset the experiment without autoplay. Red cards identify a previously deleted record that returned from backup.
Export snapshot
An export already copied to another destination is not automatically revoked by erasing the source.
Decision trace
Complete record and tombstone inventory
Technical teaching fixture, not legal advice, a GDPR/DPDP compliance assessment or an operational data-deletion service. All records and identities are fictional. The modeled policies are explicit choices, not statutory deadlines or legal bases. Verification and consent are switches, not identity checks or valid consent collection. Retention runs at days 9 and 20. Requested deletions schedule one backup purge; retention-expired backup copies remain visible and require a separate real-world policy. Tombstones block restoration; they are not anonymization. Holds are a fixture exception, not a legal determination. Real systems also need authorization roles, downstream deletion, backup lifecycle, notices, audit protection and jurisdiction-specific review. No personal information or external service is accessed. Official AICassindra learning resources.
Offboarding is more than a delete count
This local experiment separates tenant write shutdown, primary deletion, backup purge and restoration. Six fictional records begin in primary storage and backup. Alpha owns a1 through a4; beta owns b1 and b2. The export is another independent snapshot. Whole-tenant scope marks the authorized tenant offboarded at day three and denies the late write at day twelve, even if a held record or backup copy remains. No account, credential, external database or ADK service is changed. The switches describe a technical policy fixture, not a compliance determination.
Choose the request boundary
Requested tenant identifies the data owner. Actor tenant must match, and Identity verified by the fixture must be enabled, before export or requested deletion can occur. Requested subject selects s1 or s2 only when Request scope is One subject. Whole tenant ignores that selector and assumes a tenant operator; the fixture does not implement role validation. Personalization purpose consent gates the day-one use decision independently of deletion and export. Minimize export fields removes tenant, subject and age from the copied fields, but does not anonymize the record value. Disable it to inspect the full exported records.
Compare a subject with a tenant
Keep alpha as both tenants, verification enabled, retention thirty, backup delay fourteen, tombstones and the billing hold enabled. Whole tenant exports four records at day two and deletes a1, a2 and a3 at day three; held billing record a4 remains. At day twelve, the trace reports write-denied. Restart with One subject and s1: the export contains a1, a2 and a4, a3 survives the requested deletion, and the day-twelve late-1 write succeeds. Switch subject to s2 to export only a3. Switch Actor tenant to beta: neither export nor requested deletion is authorized. Scheduled retention still runs globally, so a later primary count change is not evidence that the denied request succeeded.
Make a deleted record return
Select Whole tenant, matching alpha identities, retention ninety and disable the billing hold. Disable Block restoration of deleted IDs and leave backup delay fourteen. Four alpha records are deleted on day three, return at the day-ten restore, and appear in the day-eleven failure check. Offboarding still blocks late-1: denying new writes does not remove restored old records. Set backup delay seven: the purge occurs on day ten before restore, so these records cannot return. At delay eight the purge is day eleven, too late to prevent the day-ten restore. Enabling tombstones blocks restoration even while backup copies remain. These exact event-order choices are declared fixture assumptions.
Interpret retention and playback
Retention window compares original record age plus modeled day against an inclusive cutoff; sweeps run on days nine and twenty across both tenants. Hold billing records against deletion exempts billing records from requested deletion and retention. Backup purge after deletion handles requested deletions only; retention-expired backup copies remain. The export is never revoked by deleting its source. Play reveals the precomputed events over sixty inspection seconds, with equally spaced event steps rather than a proportional day axis. Pause freezes inspection; Next event pauses at the next event; Restart resets inspection while preserving policy and speed. Inspection scrubs the trace, and Speed scales elapsed time at quarter, half, normal or double pace. Policy edits reset without autoplay and hiding the tab pauses.
Inspect and record the evidence
The diagram keeps readable labels inside a keyboard-scrollable region on narrow screens. The caption, decision trace and expandable complete inventory expose the same records as text. Capture baseline saves the visible comparison; Replace baseline refreshes it and Clear baseline removes it. The notebook persists your observations locally; Export notes downloads them. Expand experiment enters fullscreen and Exit full screen returns. Compare the record IDs at the requested deletion, restore and late-write steps rather than relying on the final count alone. Real offboarding must also handle credentials, in-flight jobs, downstream stores and failure recovery; this deterministic single-process fixture models none of those mechanisms.