Domain Retirement Guard: Log Intent Before a Destructive Automation Operation

说明与用途

使用所有权检查、精确白名单、明确批准和意图记录来保护自动化 DNS 区域删除，防止意外删除和重复重试。

问题

Automated DNS zone deletions risk removing platform‑owned zones or retrying destructive actions without operator intent, leading to missed cron jobs and duplicate queue deliveries.

结果

The guard prevents accidental deletion of platform‑owned zones, ensures explicit operator approval, logs intent for auditability, and deduplicates retries, reducing operational incidents during migrations.

工作流

• 1. Create a RemovalRequest with Zone, Ownership, OperationID, and Approved flag.
• 2. Guard checks that OperationID is present.
• 3. Guard normalizes the zone name and verifies it is in the exact allowlist of customer‑owned zones.
• 4. Guard verifies the Ownership matches the allowed zone’s ownership (customer‑owned).
• 5. Guard checks that the request is explicitly approved.
• 6. Guard records the intent (OperationID, Zone, Action, Ownership) in an IntentStore.
• 7. Guard calls the ZoneRemover.Remove adapter to delete the zone.
• 8. Guard marks the operation as completed to prevent duplicate execution.

证据

Treat deletion as a small state machine, not as a thin wrapper around a registrar or DNS provider call.

来源

The approval flag is deliberately redundant with the allowlist.

来源