Domain Retirement Guard: Log Intent Before a Destructive Automation Operation

Description and use

Guard automated DNS zone deletion with ownership checks, exact allowlist, explicit approval, and intent logging to prevent accidental deletions and duplicate retries.

Problem

Automated DNS zone deletions risk removing platform‑owned zones or retrying destructive actions without operator intent, leading to missed cron jobs and duplicate queue deliveries.

Outcome

The guard prevents accidental deletion of platform‑owned zones, ensures explicit operator approval, logs intent for auditability, and deduplicates retries, reducing operational incidents during migrations.

Workflow

• 1. Create a RemovalRequest with Zone, Ownership, OperationID, and Approved flag.
• 2. Guard checks that OperationID is present.
• 3. Guard normalizes the zone name and verifies it is in the exact allowlist of customer‑owned zones.
• 4. Guard verifies the Ownership matches the allowed zone’s ownership (customer‑owned).
• 5. Guard checks that the request is explicitly approved.
• 6. Guard records the intent (OperationID, Zone, Action, Ownership) in an IntentStore.
• 7. Guard calls the ZoneRemover.Remove adapter to delete the zone.
• 8. Guard marks the operation as completed to prevent duplicate execution.

Evidence

Treat deletion as a small state machine, not as a thin wrapper around a registrar or DNS provider call.

Source

The approval flag is deliberately redundant with the allowlist.

Source