# Delete account

**Flow key:** `account-deletion`

## Outcome

The authorized person understands the consequence, completes required proof, and the account is disabled, deleted, anonymized, or scheduled exactly according to policy.

## Actors

- Account owner
- Identity/data services
- Organization owner/admin
- Billing and retention systems

## Preconditions and entry points

- A synthetic account owns known records and may belong to a tenant.
- Retention, cooling-off, ownership-transfer, and subscription policies are known.
- Recovery is safe if promised.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Account | synthetic owner with profile and records | member, sole tenant owner, admin, suspended, paid subscriber |
| Owned data | two records, one file, one comment | shared data, legal hold, invoices, third-party integration |
| Proof | fresh step-up authentication | expired, wrong factor, SSO-managed |
| Deletion mode | policy-defined soft delete or scheduled purge | immediate purge, anonymization, cancellation during grace period |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Open account deletion from settings. | The product names affected account, data, memberships, billing, retention, and recovery window. |
| 2 | Resolve ownership, subscription, or legal prerequisites. | Transfer/cancel requirements prevent orphaned or unauthorized loss. |
| 3 | Reauthenticate and confirm explicit intent. | Confirmation is scoped and not satisfied by accidental activation. |
| 4 | Submit once. | Account access is revoked immediately or at the stated time; one deletion job exists. |
| 5 | Inspect owned/shared data and integrations. | Each artifact follows documented delete, transfer, retain, or anonymize policy. |
| 6 | Attempt login, recovery, cancellation, and final purge. | All paths match the cooling-off and irreversible-state contract. |

## Alternate paths

- Immediate self-delete
- Scheduled grace period
- Organization member leaves
- Sole owner transfers ownership
- Admin-initiated deletion

## Failure and recovery paths

- Deletion job partly fails
- Billing renews during grace period
- Login/recovery resurrects deleted identity
- Shared content leaks deleted PII
- Purge omits cache/index/backup policy

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [account and user lifecycle](../../items/identity/account-and-user-lifecycle.md)
- [delete](../../items/actions/delete.md)
- [record integrity](../../items/records/record-integrity.md)
- [privacy](../../items/quality/privacy.md)

[Back to Identity and access flows](index.md)
