Governance

Lifecycle

Runtime disconnected

Activation, suspension, offboarding, retention and closure — each a visible state with a receipt. Financial and audit records are never hard-deleted, whatever the state above them says.

What this surface will govern

Each transition issues a receipt with an author and a time
Access-grant revocation and key retirement are their own steps
Export and data requests complete before closure, not after
Financial and audit records are never hard-deleted

Declared vocabulary

These are the only values this surface’s contract admits. They are identifiers, not labels, so they read the same in every language — which is what makes them searchable in a log.

reversibilities: nonecompensableirreversible