Skip to content

2026 04 27 uelgf decommission lifecycle

Jump to bottom
github-actions[bot] edited this page Apr 30, 2026 · 2 revisions

Universal Entity Lifecycle Governance Framework (UELGF): decommission lifecycle, trigger taxonomy, procedural requirements by confidentiality, integrity, and availability (CIA) tier, ghost-entity detection and remediation, and the dependency-elimination trigger as the formal connection to systems capability debt

Research Question

How should the UELGF formally specify the decommission lifecycle, including a complete trigger taxonomy, procedural requirements differentiated by CIA tier, a ghost-entity detection and remediation mechanism, and the dependency-elimination trigger as the formal connection between the UELGF and the systems capability debt remediation programme, such that decommission is a first-class lifecycle stage with the same governance rigour as any other stage?

Scope

In scope:

  • Formal definition of decommissioned state and the conditions that must all be satisfied before an entity is considered decommissioned, registry removal, credential revocation, action cessation confirmed, dependent notification, and lifecycle archive.
  • Complete decommission trigger taxonomy: scheduled sunset, owner departure, policy violation after remediation failure, CIA rating escalation, dependency elimination, explicit decision, and ghost-entity detection.
  • For each trigger type: dependent notification with defined notice periods by CIA tier; credential revocation sequence, what credentials, in what order, by what mechanism, with what confirmation; action draining, how in-flight actions are completed or cancelled safely; data disposition, what data the entity held or generated, where it goes, who is responsible; dependency graph update in the Policy Information Point (PIP); and the archive record specification.
  • Ghost-entity detection mechanism: how the framework identifies entities operating without current registration, entities whose registered owner no longer exists, entities whose licence to operate has lapsed without formal decommission, and entities whose actual behaviour has drifted beyond their registered CIA rating.
  • Ghost-entity remediation process for each detected state.
  • The dependency-elimination trigger: the formal mechanism connecting the UELGF to the systems capability debt remediation programme. When a direct engineering solution closes the gap that a citizen-built entity was bridging, the UELGF must formally decommission that entity and record the connection.
  • Archive record specification: what is retained, in what form, for how long, under what access controls, differentiated by CIA tier and entity type.

Out of scope:

  • Foundational principles and the first-class nature of decommission as a general principle, covered by 2026-04-27-uelgf-foundational-definitions-principles.
  • Entity taxonomy and CIA classification, covered by 2026-04-27-uelgf-entity-taxonomy-cia-classification.
  • Policy architecture, covered by 2026-04-27-uelgf-policy-architecture-8-layer-context.
  • Runtime feedback-loop signal processing, covered by 2026-04-27-uelgf-runtime-feedback-loop, though the signal that triggers decommission via the feedback loop is in scope.

Constraints:

  • All decommission procedures must be specified at sufficient precision to be automatable, and they should not depend on manual steps that can be omitted.
  • Ghost-entity detection must derive from observable system state, registry entries, credential-usage logs, action logs, and dependency-graph state, rather than from entity-owner self-declaration.
  • The dependency-elimination trigger must produce a machine-readable record that can be consumed by the systems capability debt programme, and the connection must be explicit rather than inferred.

Context

  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html] Decommission is usually under-specified because many lifecycle models focus on registration, promotion, and monitoring, while the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF) and adjacent lifecycle work in this repository both treat safe phase-out as an explicit governance duty.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The systems-capability-debt thread matters here because workaround entities become persistent operational clutter unless the framework names the point at which a replacement capability eliminates the original justification for keeping the workaround alive.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] Identity and credential lifecycle evidence also matters because owner departure and stale credentials are observable signals of control failure, which makes decommission a joint lifecycle, identity, and governance problem rather than only a records-management problem.

Approach

  1. Ghost entity prevalence and detection methods: Survey evidence on ghost and orphan entity prevalence in enterprise environments, including Configuration Management Database (CMDB) reconciliation analogues, Amazon Web Services (AWS) account hygiene, and Microsoft Azure unused-resource governance, to identify detection methods that can transfer into UELGF.
  2. Credential revocation sequencing: Survey how credential revocation is handled in high-assurance systems, including Public Key Infrastructure (PKI) and OAuth 2.0 token revocation, to produce a credible revocation sequence for UELGF.
  3. Action draining patterns: Survey patterns for safe termination of in-flight operations in distributed systems, including graceful shutdown and endpoint draining, to specify how UELGF handles the transition from active to decommissioned without data loss or incomplete operations.
  4. Data disposition frameworks: Survey data-retention requirements in relevant regulatory frameworks, including the General Data Protection Regulation (GDPR) Article 5 storage-limitation principle and Markets in Financial Instruments Directive II (MiFID II) record-keeping obligations, to produce the data-disposition specification for each entity type and CIA tier.
  5. Dependency notification models: Survey how dependency notification is handled in existing service decommission processes, including Kubernetes Application Programming Interface (API) deprecation policy and AWS account decommission guidance, to produce a notification model with defined notice periods by CIA tier and dependency criticality.
  6. Archive record specification: Survey what governance frameworks require to be retained after decommission, including International Organization for Standardization / International Electrotechnical Commission (ISO/IEC) 27001 and NIST Special Publication (SP) 800-88, to produce the UELGF archive-record specification, minimum fields, retention period by CIA tier, access controls, and storage format in the PIP.
  7. Dependency-elimination trigger formalisation: Specify the formal structure of the dependency-elimination trigger, what information is recorded, what system records the event, and how the systems-capability-debt programme consumes it.

Sources

Related

Research Skill Output

(Full output from running the research skill, retained verbatim in the completed item. Sections 0-5 are the investigation, and Section 6 seeds the Findings section below.)

§0 Initialise

  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html] Research question restated: this item asks how UELGF should define decommission as a governed lifecycle stage with explicit triggers, state-exit criteria, credential and action shutdown order, archive requirements, ghost-entity handling, and a formal handoff to the systems-capability-debt programme.
  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/] Scope confirmed: the investigation covers lifecycle controls after an entity is already operating, especially retirement triggers, draining, revocation, data disposition, dependency notification, and observable-state detection.
  • [fact; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/] Constraint confirmed: ghost-entity detection must be grounded in registry, telemetry, and resource-state observations rather than in owner self-report, so the design needs concrete observable signals.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Prior work cross-reference: adjacent completed items already established the need for formal retirement controls, linked workaround estates to systems-capability debt, and showed that machine-identity lifecycle controls are prerequisites for safe withdrawal.
  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565] Output format confirmed: knowledge, specifically a decommission reference model that combines lifecycle state criteria, machine-observable detection rules, risk-tiered notice windows, and archive-retention rules.

§1 Question Decomposition

  • Root question: What decommission state model lets UELGF retire an entity with the same rigour used to approve and operate it?
  • A. State definition
    • A1. Which conditions must all be satisfied before an entity counts as decommissioned?
    • A2. Which records must remain after decommission?
  • B. Trigger taxonomy
    • B1. Which trigger classes are externally mandated by standards or platform analogues?
    • B2. Which trigger classes are UELGF-specific governance inferences?
  • C. Credential and access shutdown
    • C1. What is the safe order for draining work and revoking credentials?
    • C2. Which credential classes need different revocation mechanics?
  • D. In-flight action handling
    • D1. How should UELGF stop new work without corrupting work already in progress?
    • D2. What evidence shows a drain or cancellation was completed safely?
  • E. Data disposition and archive
    • E1. What must be retained as governance evidence?
    • E2. What must be deleted, anonymised, or transferred under storage-limitation rules?
  • F. Dependency communication
    • F1. What minimum notice model is defensible from platform deprecation practice?
    • F2. How should notice periods vary by CIA tier?
  • G. Ghost entities
    • G1. Which observable mismatches indicate an off-rail or orphaned entity?
    • G2. What remediation should follow each ghost-entity state?
  • H. Systems-capability-debt connection
    • H1. What record proves that a workaround entity existed because of a capability gap?
    • H2. What record proves that the gap was closed and the workaround was removed?

§2 Investigation

Source access and applicability notes

  • [fact; source: https://www.servicenow.com/docs/r/servicenow-platform/configuration-management-database-cmdb/id-detect-dup-ci.html] Access note: seeded ServiceNow duplicate-Configuration-Item page, loading shell only in this runtime, not used for downstream ghost-detection support.
  • [fact; source: https://www.apra.gov.au/sites/default/files/Prudential-Standard-CPS-231-Outsourcing-%28July-2017%29.pdf] Access note: seeded APRA Portable Document Format (PDF), checked, no extractable retention clause confirmed in this runtime, not used for archive-retention support.
  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] This investigation prioritised primary standards and platform documents for state, revocation, retention, and shutdown claims, and used prior completed repository items only where they sharpen the same control surface.

A. Decommission is already a first-class governance duty in the source corpus

  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/] NIST AI RMF states that risk management should be continuous throughout the AI-system lifecycle, requires ongoing monitoring and periodic review in Govern 1.5, requires inventory mechanisms in Govern 1.6, and requires safe decommissioning and phasing out in Govern 1.7.
  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html] The standards baseline therefore does not support treating retirement as an optional cleanup step, because the same governance system that admits an entity into operation is expected to inventory it, review it, and retire it safely.
  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] A UELGF entity should count as decommissioned only when five conditions all hold, no new work can be admitted, all in-flight work is completed or cancelled, credentials no longer authorize action, dependencies have been updated or warned, and a lifecycle archive has been sealed.

B. Trigger taxonomy

  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://kubernetes.io/docs/reference/using-api/deprecation-policy/] External analogues support at least four generic trigger classes, planned end-of-life, risk-review failure, version or policy incompatibility, and explicit replacement or removal.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] For UELGF, the complete workable taxonomy is scheduled sunset, explicit governance decision, owner departure without timely reassignment, policy violation after failed remediation, CIA-tier escalation beyond approved envelope, dependency elimination, and ghost-entity detection.
  • [inference; source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Owner departure is a valid decommission trigger because standing credentials are expected to be updated when an employee leaves, and the repository's identity work shows that non-human actors must retain an accountable steward.
  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.iso.org/standard/27001] CIA-tier escalation is a valid trigger because governance frameworks require risk management to stay aligned with current confidentiality, integrity, and availability exposure, so an entity whose actual behaviour exceeds its registered tier has left its approved operating envelope.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Dependency elimination must be a first-class trigger because workaround entities that remain after a direct engineering solution lands preserve the cost and risk of the debt they were supposed to bridge.

C. Observable ghost-entity states and detection rules

  • [fact; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph; https://learn.microsoft.com/en-us/azure/advisor/advisor-overview] Azure Resource Graph can query live resource properties and recent configuration changes at scale, while Advisor recommendations can be queried centrally through Resource Graph, which means platform state can be compared against registry state without relying on owner declarations.
  • [fact; source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] AWS provides observable last-used data for access keys, a post-closure state for accounts, and explicit failure of delegated access after account closure, which makes credential activity and post-closure access attempts usable as decommission-verification signals.
  • [inference; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] UELGF can therefore define four machine-detectable ghost states, unregistered active entity, registered entity with no current accountable owner, formally retired entity with continuing credential or action activity, and registered entity whose observed data access, output channel, or write scope exceeds its approved CIA tier.
  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] The core detection rule is registry-to-runtime divergence, where asset discovery, credential use, dependency links, or behavioural telemetry disagree with the registry record that is supposed to define the entity's approved existence and scope.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Ghost-entity remediation should differ by state: unregistered active entities should be quarantined into read-only or no-new-work mode pending forced registration; orphaned entities should be frozen for change and reassigned within a fixed grace period; lapsed entities with ongoing activity should trigger immediate credential revocation; and tier-drifted entities should be suspended or reclassified before they resume.

D. Action draining and credential-revocation order

  • [fact; source: https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/] Kubernetes termination flow shows that a terminating endpoint can be marked ready: false, serving: true, and terminating: true, which stops new traffic while allowing existing connections to drain.
  • [fact; source: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/] Kubernetes PreStop hooks must complete before the termination signal is sent, and the total drain plus stop time still has to fit within the termination grace period.
  • [fact; source: https://datatracker.ietf.org/doc/html/rfc7009] RFC 7009 says revocation invalidates the submitted token and, when applicable, other tokens based on the same authorization grant and the authorization grant itself.
  • [fact; source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] AWS recommends a standing-key replacement sequence of create new key, update applications, verify old-key inactivity, deactivate old key, validate behaviour, and then delete the old key.
  • [inference; source: https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/; https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] The safest generic UELGF order is therefore freeze new admissions first, drain or compensate in-flight work second, revoke user-grant and refresh-token pathways third, deactivate long-lived service credentials fourth, observe for residual activity fifth, and delete or destroy credentials only after the no-further-use check passes.
  • [inference; source: https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] That order matters because immediate revocation before drain can strand partial work, while immediate deletion of credentials removes the reversible observation window that AWS explicitly recommends during key retirement.

E. Notification model and notice periods

  • [fact; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/] Kubernetes requires deprecated beta API versions to remain served for at least nine months or three minor releases after deprecation, and requires deprecated generally available API versions not to be removed within a major version.
  • [fact; source: https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] AWS uses a 90-day post-closure period for account reopening, and says cross-account access should fail after closure, which shows that platform decommission processes often include a bounded recovery window and explicit dependency break.
  • [assumption; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] UELGF notice windows should be Low CIA: 30 days, Medium CIA: 90 days, High CIA: 180 days, with an emergency exception for active compromise or severe policy breach. Justification: platform analogues show that retirement needs a non-trivial adaptation window, and higher CIA entities impose larger dependency and control-verification burdens than low-tier entities.
  • [inference; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] The notice event itself should update the registry, the dependency graph, and the downstream communication log at the same time, so that dependency owners can be warned and later checked for acknowledgement before final cutover.

F. Data disposition and archive specification

  • [fact; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504] GDPR Article 5(1)(e) says personal data must be kept in a form permitting identification for no longer than is necessary for the purposes for which it is processed, with a narrow archiving exception under appropriate safeguards.
  • [fact; source: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565] Commission Delegated Regulation (EU) 2017/565 Article 76 requires investment-firm records to be retained for at least five years and allows competent authorities to require retention up to seven years.
  • [fact; source: https://csrc.nist.gov/pubs/sp/800/88/r1/final] NIST SP 800-88 says sanitization decisions should be based on the confidentiality categorisation of the information on the media.
  • [fact; source: https://www.iso.org/standard/27001] ISO/IEC 27001 frames information-security management around risk-managed protection of confidentiality, integrity, and availability.
  • [fact; source: https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] AWS says customers should back up data they want to keep before closure, and notes that CloudTrail trails can continue to exist after account closure unless explicitly deleted.
  • [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] UELGF should separate operational payload retention from governance-archive retention, because GDPR minimisation points toward deleting or anonymising unnecessary payload data, while regulated governance evidence may need longer retention to prove who approved, operated, and retired the entity.
  • [assumption; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final] A defensible minimum archive schedule is Low CIA: 2 years for governance records, Medium CIA: 5 years, High CIA: 7 years, while operational payload follows the stricter of the source-system rule or applicable regulation. Justification: GDPR argues against indefinite payload retention, MiFID II provides five-year and seven-year regulatory anchors, and NIST SP 800-88 supports stricter sanitisation as confidentiality rises.
  • [inference; source: https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] The archive record must include entity identifier, type, approved CIA tier, owner and steward identities, trigger type, dependency list, notice evidence, drain outcome, credential-revocation confirmations, data-disposition decision, linked capability-debt item when relevant, approver identity, and immutable pointers to logs and retained artefacts.

G. Dependency-elimination trigger as the systems-capability-debt bridge

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] A workaround entity should not simply age out; it should be retired when the specific capability gap that justified its existence is closed by a sanctioned engineering solution.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview] The dependency-elimination trigger therefore needs a machine-readable record that names the entity being retired, the capability-gap item it bridged, the replacement Application Programming Interface (API), integration, or data product that closed the gap, the production-live date of that replacement, and the archive identifier for the retirement evidence.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] That record is the formal bridge to the systems-capability-debt programme because it converts a previously informal workaround into a measurable debt-remediation event with a before-and-after control-state trace.

§3 Reasoning

  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html] The strongest direct support in the corpus is for making decommission a mandatory lifecycle phase with explicit state criteria.
  • [inference; source: https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/; https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] The strongest procedural support is for sequencing shutdown as freeze, drain, revoke, observe, and destroy, because each source covers one part of that sequence and none of them support delete-first retirement.
  • [inference; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] The ghost-entity mechanism is mostly an inference from observable-state tools and identity-lifecycle evidence rather than from a single formal ghost-entity standard.
  • [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final] Archive retention by CIA tier is an applied governance synthesis, not a directly prescribed schedule in one source, so the exact year counts carry lower confidence than the underlying need for differentiated retention and sanitisation.

§4 Consistency Check

  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] No source contradicted the need for explicit inventory, monitoring, warning, and decommission controls, and the main variation across sources concerns the exact length of notice or recovery windows rather than the existence of such windows.
  • [inference; source: https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] The proposed shutdown order is internally consistent because it preserves both safe termination of work and reversible verification of credential inactivity before irreversible deletion.
  • [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565] The only material unresolved tension is between GDPR minimisation pressure and regulated record-retention duties, which is why the synthesis separates payload data from governance evidence rather than assigning one blanket retention rule to both.

§5 Depth and Breadth Expansion

  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview] Technical lens: decommission is really a control-plane function, because the decisive event is not a manager saying an entity is retired but the registry, discovery layer, and credential systems all converging on the same retired state.
  • [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://www.iso.org/standard/27001] Regulatory lens: retention and deletion cannot be collapsed into one act, because governance evidence often needs to outlive operational payload, especially where the entity acted on regulated records or personal data.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] Economic lens: the dependency-elimination trigger is economically important because it stops organisations from paying the continuing cognitive, control, and monitoring cost of workaround entities after the sanctioned capability already exists.
  • [inference; source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Behavioural lens: owner departure and stale credentials are where organisations most often reveal that they do not truly know which non-human actors still exist, so those events should be treated as active discovery triggers rather than as passive housekeeping tasks.

§6 Synthesis

(This section seeds the Findings below.)

Executive summary:

  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] UELGF should define decommission as a gated lifecycle state that is reached only after new work is blocked, in-flight work is drained or cancelled safely, credentials are revoked through a staged sequence, dependencies are updated, and an archive record is sealed.
  • [inference; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] Ghost-entity control should be based on registry-to-runtime divergence, because resource discovery, configuration-change history, and credential last-used signals provide machine-observable evidence that an entity exists off-rail or remains active after its approved lifecycle ended.
  • [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final] The framework should retain governance evidence longer than operational payload, because storage-limitation rules constrain unnecessary payload retention while regulated record-keeping and confidentiality-based sanitisation justify a separate archive policy.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The dependency-elimination trigger should be the formal bridge between UELGF and the systems-capability-debt programme, because it turns replacement of workaround entities into a measurable remediation event instead of an informal cleanup aspiration.

Key findings:

  1. [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] High confidence: A UELGF entity should be considered decommissioned only when five exit conditions are simultaneously true, no new work can be admitted, all in-flight work has been completed or cancelled safely, credentials no longer authorize activity, dependencies have been updated or warned, and a lifecycle archive record has been sealed.
  2. [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Medium confidence: The complete trigger taxonomy should include scheduled sunset, explicit decision, owner departure, policy violation after failed remediation, CIA-tier escalation, dependency elimination, and ghost-entity detection, because the taxonomy combines standards-backed lifecycle obligations with governance inferences required to retire workaround entities and reconcile off-rail runtime activity.
  3. [inference; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] High confidence: Ghost-entity detection should be implemented as registry-to-runtime reconciliation across discovered resources, recent configuration changes, credential last-used evidence, and dependency links, because those signals expose unregistered, orphaned, lapsed, and tier-drifted entities without depending on owner honesty or awareness.
  4. [inference; source: https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/; https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] High confidence: The decommission sequence should be freeze new admissions, drain or compensate work, revoke grants and session pathways, deactivate standing credentials, verify inactivity, and only then destroy credentials, because the source corpus consistently supports graceful shutdown and reversible verification rather than delete-first termination.
  5. [assumption; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Medium confidence: UELGF should set minimum dependency-notice windows of 30 days for Low CIA, 90 days for Medium CIA, and 180 days for High CIA entities, with emergency override for active compromise, because platform deprecation practice shows a need for bounded adaptation windows and higher-tier entities carry heavier dependency and assurance burdens.
  6. [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final; https://www.iso.org/standard/27001] High confidence: UELGF should separate operational payload disposition from governance-archive retention, because personal-data minimisation and confidentiality-based sanitisation argue for deletion or anonymisation of unnecessary payload, while regulated oversight still requires durable proof of how the entity was approved, operated, and retired.
  7. [assumption; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final] Medium confidence: A workable minimum governance-archive schedule is 2 years for Low CIA entities, 5 years for Medium CIA entities, and 7 years for High CIA or regulated-record entities, while operational payload follows the stricter of the source-system rule or applicable regulation.
  8. [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html] Medium confidence: The dependency-elimination trigger should record the retired entity, the capability-gap item it bridged, the sanctioned replacement capability, the replacement-live date, and the retirement archive identifier, because that is what turns workaround retirement into an auditable systems-capability-debt remediation event.

Evidence map:

Claim Source Confidence Notes
[inference] Decommission requires five simultaneous exit conditions rather than a single status flip. https://airc.nist.gov/airmf-resources/airmf/5-sec-core/ ; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html ; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html high Combines lifecycle-governance baseline with explicit post-closure controls.
[inference] The complete trigger taxonomy includes sunset, explicit decision, owner departure, policy failure, CIA escalation, dependency elimination, and ghost detection. https://airc.nist.gov/airmf-resources/airmf/5-sec-core/ ; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html ; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview ; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html ; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html medium Standards cover part of the taxonomy; dependency elimination and ghost detection are applied UELGF synthesis.
[inference] Ghost-entity detection should use registry-to-runtime reconciliation across resources, credentials, and dependency state. https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview ; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph ; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html ; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html high Observable-state detection rather than owner declaration.
[inference] Safe retirement order is freeze, drain, revoke, deactivate, observe, destroy. https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/ ; https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/ ; https://datatracker.ietf.org/doc/html/rfc7009 ; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html high Each source anchors one step of the sequence.
[assumption] Minimum notice windows should be 30, 90, and 180 days by CIA tier. https://kubernetes.io/docs/reference/using-api/deprecation-policy/ ; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html medium Exact day counts are an applied governance choice, not a direct mandate.
[inference] Payload retention and governance-archive retention must be governed separately. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504 ; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565 ; https://csrc.nist.gov/pubs/sp/800/88/r1/final ; https://www.iso.org/standard/27001 high Resolves minimisation versus auditability tension.
[assumption] Minimum archive retention should be 2, 5, and 7 years by CIA tier. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504 ; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565 ; https://csrc.nist.gov/pubs/sp/800/88/r1/final medium Year bands are inferred from regulatory anchors and sensitivity-based sanitisation.
[inference] Dependency elimination is the formal bridge from UELGF to systems-capability-debt remediation. https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html ; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html ; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html medium Strong repository synthesis, but not yet supported by independent primary sources as a named external control pattern.

Assumptions:

  • [assumption; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Notice windows by CIA tier: UELGF should use 30, 90, and 180 days for Low, Medium, and High CIA entities. Justification: the corpus shows a need for explicit adaptation windows, but it does not prescribe UELGF-specific day counts.
  • [assumption; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final] Archive-retention schedule: UELGF should use 2, 5, and 7 years for Low, Medium, and High CIA governance archives. Justification: the corpus supports differentiated retention and sanitisation, but it does not prescribe a universal enterprise schedule across all entity classes.

Analysis:

  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview] The most defensible design choice is to define decommission as a convergence test across registry, runtime, credential, and archive state, because inventory and monitoring obligations make lifecycle status meaningful only when observable systems agree with the registry.
  • [inference; source: https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] Platform shutdown evidence strongly favours reversible retirement stages over one-step deletion, so UELGF should explicitly distinguish draining, deactivated, and destroyed credential states instead of collapsing them into one boolean retired flag.
  • [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Retention trade-offs are resolved by separating payload and governance evidence, because the organisation usually needs durable proof of retirement even when it should no longer keep the underlying personal or operational payload.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The dependency-elimination trigger is the most UELGF-specific contribution in this item, because it ties retirement not only to risk and hygiene but also to the explicit closure of the capability gap that originally justified the entity.
  • [inference; source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Owner departure was weighed more heavily than a conventional housekeeping trigger because the evidence shows it is also a credential-lifecycle trigger, which makes missing stewardship an active risk signal rather than an administrative nuisance.

Risks, gaps, uncertainties:

  • [fact; source: https://www.apra.gov.au/sites/default/files/Prudential-Standard-CPS-231-Outsourcing-%28July-2017%29.pdf] The seeded APRA source was checked but not used for downstream archive-retention claims, so the prudential-banking angle in this item rests more on MiFID-style record-retention anchors and prior repository governance work than on a directly extracted APRA clause.
  • [fact; source: https://www.servicenow.com/docs/r/servicenow-platform/configuration-management-database-cmdb/id-detect-dup-ci.html] The seeded ServiceNow duplicate-detection page was not machine-readable in this runtime, so the ghost-entity detection design relies on other observable-state sources rather than on direct CMDB reconciliation text from ServiceNow.
  • [assumption; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Exact notice windows by CIA tier remain an applied governance choice and would need owner confirmation if UELGF must hard-code different numbers.
  • [assumption; source: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504] Exact archive-retention years for non-regulated Low CIA entities remain a policy choice rather than a directly mandated number in the reviewed corpus.

Open questions:

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Should UELGF require a mandatory escrow steward for High CIA entities so that owner departure triggers reassignment before full decommission becomes necessary?
  • [inference; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph] Should ghost-entity detection run as a central daily reconciliation job, or should each platform adapter publish divergence events directly into the control plane?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] Should the systems-capability-debt programme treat failure to retire a workaround after replacement goes live as a distinct governance violation with its own timer and escalation path?

§7 Recursive Review

  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565] Every material claim in the synthesis is either directly sourced or explicitly labelled as an inference or assumption, and the two assumption classes are limited to CIA-tier notice windows and CIA-tier archive-retention durations.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] Adjacent completed repository items were rechecked after drafting, and the current synthesis now cites the most relevant prior work for lifecycle, identity, and systems-capability-debt governance surfaces.
  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/] The answer is coherent because it translates standards duties into machine-observable state transitions instead of leaving decommission as policy prose without detection or enforcement hooks.

Findings

Executive Summary

  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] UELGF should define decommission as a gated lifecycle state that is reached only after new work is blocked, in-flight work is drained or cancelled safely, credentials are revoked through a staged sequence, dependencies are updated, and an archive record is sealed.
  • [inference; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] Ghost-entity control should be based on registry-to-runtime divergence, because resource discovery, configuration-change history, and credential last-used signals provide machine-observable evidence that an entity exists off-rail or remains active after its approved lifecycle ended.
  • [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final] The framework should retain governance evidence longer than operational payload, because storage-limitation rules constrain unnecessary payload retention while regulated record-keeping and confidentiality-based sanitisation justify a separate archive policy.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The dependency-elimination trigger should be the formal bridge between UELGF and the systems-capability-debt programme, because it turns replacement of workaround entities into a measurable remediation event instead of an informal cleanup aspiration.

Key Findings

  1. [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] High confidence: A UELGF entity should be considered decommissioned only when five exit conditions are simultaneously true, no new work can be admitted, all in-flight work has been completed or cancelled safely, credentials no longer authorize activity, dependencies have been updated or warned, and a lifecycle archive record has been sealed.
  2. [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Medium confidence: The complete trigger taxonomy should include scheduled sunset, explicit decision, owner departure, policy violation after failed remediation, CIA-tier escalation, dependency elimination, and ghost-entity detection, because the taxonomy combines standards-backed lifecycle obligations with governance inferences required to retire workaround entities and reconcile off-rail runtime activity.
  3. [inference; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] High confidence: Ghost-entity detection should be implemented as registry-to-runtime reconciliation across discovered resources, recent configuration changes, credential last-used evidence, and dependency links, because those signals expose unregistered, orphaned, lapsed, and tier-drifted entities without depending on owner honesty or awareness.
  4. [inference; source: https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/; https://datatracker.ietf.org/doc/html/rfc7009; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] High confidence: The decommission sequence should be freeze new admissions, drain or compensate work, revoke grants and session pathways, deactivate standing credentials, verify inactivity, and only then destroy credentials, because the source corpus consistently supports graceful shutdown and reversible verification rather than delete-first termination.
  5. [assumption; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Medium confidence: UELGF should set minimum dependency-notice windows of 30 days for Low CIA, 90 days for Medium CIA, and 180 days for High CIA entities, with emergency override for active compromise, because platform deprecation practice shows a need for bounded adaptation windows and higher-tier entities carry heavier dependency and assurance burdens.
  6. [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final; https://www.iso.org/standard/27001] High confidence: UELGF should separate operational payload disposition from governance-archive retention, because personal-data minimisation and confidentiality-based sanitisation argue for deletion or anonymisation of unnecessary payload, while regulated oversight still requires durable proof of how the entity was approved, operated, and retired.
  7. [assumption; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final] Medium confidence: A workable minimum governance-archive schedule is 2 years for Low CIA entities, 5 years for Medium CIA entities, and 7 years for High CIA or regulated-record entities, while operational payload follows the stricter of the source-system rule or applicable regulation.
  8. [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html] Medium confidence: The dependency-elimination trigger should record the retired entity, the capability-gap item it bridged, the sanctioned replacement capability, the replacement-live date, and the retirement archive identifier, because that is what turns workaround retirement into an auditable systems-capability-debt remediation event.

Evidence Map

Claim Source Confidence Notes
[inference] Decommission requires five simultaneous exit conditions rather than a single status flip. https://airc.nist.gov/airmf-resources/airmf/5-sec-core/ ; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html ; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html high Combines lifecycle-governance baseline with explicit post-closure controls.
[inference] The complete trigger taxonomy includes sunset, explicit decision, owner departure, policy failure, CIA escalation, dependency elimination, and ghost detection. https://airc.nist.gov/airmf-resources/airmf/5-sec-core/ ; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html ; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview ; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html ; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html medium Standards cover part of the taxonomy; dependency elimination and ghost detection are applied UELGF synthesis.
[inference] Ghost-entity detection should use registry-to-runtime reconciliation across resources, credentials, and dependency state. https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview ; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph ; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html ; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html high Observable-state detection rather than owner declaration.
[inference] Safe retirement order is freeze, drain, revoke, deactivate, observe, destroy. https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/ ; https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/ ; https://datatracker.ietf.org/doc/html/rfc7009 ; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html high Each source anchors one step of the sequence.
[assumption] Minimum notice windows should be 30, 90, and 180 days by CIA tier. https://kubernetes.io/docs/reference/using-api/deprecation-policy/ ; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html medium Exact day counts are an applied governance choice, not a direct mandate.
[inference] Payload retention and governance-archive retention must be governed separately. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504 ; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565 ; https://csrc.nist.gov/pubs/sp/800/88/r1/final ; https://www.iso.org/standard/27001 high Resolves minimisation versus auditability tension.
[assumption] Minimum archive retention should be 2, 5, and 7 years by CIA tier. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504 ; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565 ; https://csrc.nist.gov/pubs/sp/800/88/r1/final medium Year bands are inferred from regulatory anchors and sensitivity-based sanitisation.
[inference] Dependency elimination is the formal bridge from UELGF to systems-capability-debt remediation. https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html ; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html ; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html medium Strong repository synthesis, but not yet supported by independent primary sources as a named external control pattern.

Assumptions

  • [assumption; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Notice windows by CIA tier: UELGF should use 30, 90, and 180 days for Low, Medium, and High CIA entities. Justification: the corpus shows a need for explicit adaptation windows, but it does not prescribe UELGF-specific day counts.
  • [assumption; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://csrc.nist.gov/pubs/sp/800/88/r1/final] Archive-retention schedule: UELGF should use 2, 5, and 7 years for Low, Medium, and High CIA governance archives. Justification: the corpus supports differentiated retention and sanitisation, but it does not prescribe a universal enterprise schedule across all entity classes.

Analysis

  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview] The most defensible design choice is to define decommission as a convergence test across registry, runtime, credential, and archive state, because inventory and monitoring obligations make lifecycle status meaningful only when observable systems agree with the registry.
  • [inference; source: https://kubernetes.io/docs/tutorials/services/pods-and-endpoint-termination-flow/; https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/; https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html] Platform shutdown evidence strongly favours reversible retirement stages over one-step deletion, so UELGF should explicitly distinguish draining, deactivated, and destroyed credential states instead of collapsing them into one boolean retired flag.
  • [inference; source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504; https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Retention trade-offs are resolved by separating payload and governance evidence, because the organisation usually needs durable proof of retirement even when it should no longer keep the underlying personal or operational payload.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] The dependency-elimination trigger is the most UELGF-specific contribution in this item, because it ties retirement not only to risk and hygiene but also to the explicit closure of the capability gap that originally justified the entity.
  • [inference; source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Owner departure was weighed more heavily than a conventional housekeeping trigger because the evidence shows it is also a credential-lifecycle trigger, which makes missing stewardship an active risk signal rather than an administrative nuisance.

Risks, Gaps, and Uncertainties

  • [fact; source: https://www.apra.gov.au/sites/default/files/Prudential-Standard-CPS-231-Outsourcing-%28July-2017%29.pdf] The seeded APRA source was checked but not used for downstream archive-retention claims, so the prudential-banking angle in this item rests more on MiFID-style record-retention anchors and prior repository governance work than on a directly extracted APRA clause.
  • [fact; source: https://www.servicenow.com/docs/r/servicenow-platform/configuration-management-database-cmdb/id-detect-dup-ci.html] The seeded ServiceNow duplicate-detection page was not machine-readable in this runtime, so the ghost-entity detection design relies on other observable-state sources rather than on direct CMDB reconciliation text from ServiceNow.
  • [assumption; source: https://kubernetes.io/docs/reference/using-api/deprecation-policy/; https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-closing.html] Exact notice windows by CIA tier remain an applied governance choice and would need owner confirmation if UELGF must hard-code different numbers.
  • [assumption; source: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0565; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504] Exact archive-retention years for non-regulated Low CIA entities remain a policy choice rather than a directly mandated number in the reviewed corpus.

Open Questions

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Should UELGF require a mandatory escrow steward for High CIA entities so that owner departure triggers reassignment before full decommission becomes necessary?
  • [inference; source: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview; https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph] Should ghost-entity detection run as a central daily reconciliation job, or should each platform adapter publish divergence events directly into the control plane?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] Should the systems-capability-debt programme treat failure to retire a workaround after replacement goes live as a distinct governance violation with its own timer and escalation path?

Output

Navigation

Home

By Tag

bureaucracy

change-management

coase

constraint-analysis

control-model

decision-rights

delegation

delivery-risk

demand-segmentation

enterprise

exception-handling

execution

flow

flow-design

flow-metrics

governance

governance-patterns

incentives

instability

institutional-economics

leading-indicators

operating-model

organisation

organisational-design

queue-design

queueing

regulated-enterprise

routing

throughput

throughput-risk

transaction-costs

triage

williamson

Clone this wiki locally