Ban
Blocks tenant sign-in, API access, ingestion, background jobs, notifications, and support impersonation. Every ban requires an operator reason and creates an audit event.
Reversible deletion
Removes the tenant from service while retaining its findings, users, configuration, and reserved identifiers. Operators confirm deletion by typing the tenant slug.
Restore
Returns a deleted tenant to its previous access state. A tenant that was already banned remains banned until an operator explicitly restores access.
Diagnostics
Runs a read-only tenant health check for migrated schema state, integration duplicates, secret references, seed markers, and broken runbook links. Successful reads are audited.
Deletion and data rights
Platform-admin deletion is intentionally reversible and retains tenant data indefinitely. It is separate from the tenant-controlled data-rights deletion workflow, which permanently erases tenant-scoped records and cannot be restored. Tenants containing platform-admin accounts are protected from ban and deletion.