Retiring a tenant by enumeration

Deleting a tenant is easy. Knowing that everything belonging to it is gone is the hard part, because the data is spread across run records, schedules, credentials, caches, logs and derived copies, and the store nobody remembered is the one that becomes a retention question later.

Enumerate first. List the stores keyed by the tenant identifier and count what each holds, and use that list as the checklist the deletion will be verified against. Writing the list first is what stops the deletion from being a guess.

Revoke the tenant's credentials before deleting data, so nothing can add a fresh record while the deletion runs. Then delete source data before derived copies, because a derived copy can be rebuilt from a source that still exists.

def offboard(tenant, stores, revoke):
    revoke(tenant["id"])
    for name in ("runs", "schedules", "caches", "indexes", "logs"):
        stores[name].delete_by_tenant(tenant["id"])
    remaining = {n: stores[n].count_by_tenant(tenant["id"]) for n in stores}
    return {"empty": all(v == 0 for v in remaining.values()), "remaining": remaining}

Confirm completion by reading each store back rather than trusting the delete response, and keep the counts as the record that the work was done.