Deletion is the purest irreversible action. A payment can sometimes be recalled and a message can be followed by an apology, but a record that has been permanently deleted is gone. If it was needed for a dispute, a regulatory request or a customer's rights, nothing brings it back. So permanent deletion belongs at the highest depth an agent may hold, or with a named person.
Why is deletion different from other irreversible actions?
Most irreversible actions are hard to undo because someone else is involved: a receiving bank, a regulator, a customer who has read a message. Deletion is irreversible on its own terms. There is no counterparty to ask. The information is simply absent.
That has two consequences. First, there is no partial recovery. With a mistaken payment, you may get some of the money back. With a deleted record, you either kept a copy or you did not. Second, the harm often arrives later. Nobody notices a deleted record until someone asks for it, which may be months after the deletion, when a complaint escalates or an investigation begins. The detailed answer to whether deleting data is an irreversible action covers the edge cases, such as backups and replicas.
Why would an agent delete data at all?
Agents meet deletion in several legitimate ways. Each has a different risk.
| Situation | Why deletion is asked for | What can go wrong |
|---|---|---|
| A customer's erasure request | Data protection law may give people a right to have data erased | Records still required by law, or needed for an open dispute, are deleted too |
| Retention schedule enforcement | Data past its retention period should not be kept | The schedule is wrong, or a legal hold was not applied |
| Clean-up of duplicates and test data | Housekeeping | Live records are mistaken for duplicates |
| Removing data an agent should not have seen | Correcting an access error | Evidence of the error itself is lost |
| An agent tidying its own workspace | Freeing space, removing drafts | Drafts that were the basis of a decision disappear |
The last row deserves attention. Agents with broad write access sometimes delete as a side effect of doing something else, such as replacing a file or clearing a temporary table. That is the deletion nobody decided to make.
What must be checked before anything is deleted?
Deletion should never rest on one condition. A record may be past its retention date and still be required.
- Retention duties. Financial crime rules, tax rules and sector regulators require certain records to be kept for set periods. A deletion that would breach one must be refused.
- Legal holds. Records relevant to litigation, a complaint, an investigation or a regulatory request must be preserved, whatever the schedule says.
- Open matters. Records tied to an open dispute, claim or case in collections or elsewhere may be the evidence the firm needs.
- Dependencies. Other records or decisions may rely on this one; deleting it may make an earlier decision impossible to reconstruct.
- Scope. The deletion must cover exactly what was intended, including copies in replicas and caches, and nothing else.
An agent can perform most of these checks well. It can look up retention rules, search for holds and open matters, and map dependencies. It should not be the final authority on whether they are all clear.
What depth should deletion carry?
The answer depends on whether the deletion is permanent.
- Depth 1–2: identify candidate records, check retention, holds and dependencies, and draft a deletion proposal for a person.
- Depth 3: move records into a quarantine state, a soft delete, from which they can be restored for a defined period. This is reversible and can run within bounds.
- Depth 4 or a person: permanent deletion from quarantine, after the restore window, with the checks above re-run at the moment of action.
The quarantine step turns one irreversible action into two actions, one reversible and one not, separated by time. That gap is where mistakes are found. It is the same idea that makes holding a payment safer than sending it.
How does this compare with other sectors?
In lending, irreversibility comes from funds released and commitments made. In payments, it comes from settlement, which on instant rails is immediate. Deletion is unusual because it cuts across every sector. A bank, an insurer, a hospital and a public body all hold records that must be kept and records that must be deleted, sometimes the same record at different times. The broader comparison is in how irreversibility differs between sectors.
What should the record show?
A deletion record is a strange thing: evidence that evidence was removed. It should show what was deleted, at whose request, under which rule, which checks were run and their results, who approved the permanent step, and when. It should not contain the deleted data itself, or the deletion is not real. Keeping the deletion record in an append-only store means the firm can always show that a deletion was lawful, even though it cannot show what was deleted.
Where Pryme fits
In Pryme, deletion is a capability with its own depth. Permanent deletion is held for a named person unless your plan and Attest evidence support depth 4 for that specific capability, and the lower of the two wins. Every deletion verdict is filed, without the deleted content. See why autonomy in regulated industries is a question about reversal.
Questions people ask
Can an agent handle erasure requests?
It can do most of the work: finding the data, checking what must be retained, and preparing the response. The permanent deletion and the final reply should be approved by a person, because both are hard to undo.
Are backups a safety net for deletion mistakes?
Sometimes, but restoring from backup is slow, may restore too much, and may conflict with the reason the data was deleted. Treat backups as disaster recovery, not as an undo button.
Should agents be able to delete their own drafts?
Drafts that informed a decision are part of its evidence. Keep them under the same retention rules as the decision, and do not let agents delete them as housekeeping.