Implement a document-deletion propagation contract

Deleting a source document is incomplete when its chunks, embeddings, cached answers or evaluation copies survive. Retrieval systems need a deletion contract as explicit as their ingestion contract.

Build the decision artifact

Assign a stable source identifier to every derivative. On deletion or permission revocation, issue a versioned event, remove serving copies, invalidate caches and preserve only a non-content tombstone where audit requires it. Collect acknowledgements, reconcile missing consumers and measure deletion lag.

The enterprise delivery lab makes this reasoning executable with synthetic data:

from enterprise_cases import deletion_contract_case

result = deletion_contract_case()
assert len(result["copies"]) == 5
assert result["all_acknowledged"] is True
assert result["contract"]["vector_index"] == "delete"
assert result["audit_content_retained"] is False

The synthetic contract enumerates five copies. Four delete content; the audit reference becomes a tombstone. Every consumer acknowledges, and no audit content remains. This is a deterministic success fixture, so an operational test must also simulate a missing acknowledgement and repair.

Test the failure path

A best-effort message can be lost, and a full re-index can resurrect deleted content from an old snapshot. Use durable events, reconciliation against source truth and backup retention rules. Verify by attempting retrieval and direct lookup, not by trusting a queue status.

Save evidence that another reviewer can inspect:

• derivative lineage keyed by source id
• deletion event and consumer contract
• acknowledgement plus lag report
• negative retrieval and backup-restore test

This exercise aligns with the enterprise delivery, secure integration, operations and leadership work in the FDE for Professionals course. The course link describes the pathway; this local draft and its synthetic verifier do not claim that a client deployment, security approval or production result occurred.

Practice task

Create one synthetic document, trace its copies, delete it and prove that each serving path denies it while the audit trail reveals only the deletion fact.

Continue learning

This article is part of the Enterprise AI delivery and architecture sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Design an approval inbox with explicit ownership.
• Continue with Build a second-tenant onboarding plan from a first deployment.

Reference: OWASP: Vector and Embedding Weaknesses.