{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T01:25:58.088Z",
  "record_id": "VXI-EXT-PROCUREMENT-SLACK-SCIM-DEACTIVATION-01-v1",
  "record_kind": "external_reference",
  "title": "Slack SCIM: Deactivation is not permanent deletion",
  "system": "Slack SCIM",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a successful Slack SCIM offboarding action prove user data was erased?",
  "near_questions": [
    "Does SCIM deactivation prove user data was erased?",
    "Can Slack SCIM permanently delete a user?",
    "Which role controls the SCIM token authority?",
    "Can an administrator token change an owner account?",
    "Does Enterprise SCIM act at workspace or organisation scope?",
    "What evidence supports an offboarding completion claim?",
    "Should an agent report deletion after deactivation?",
    "Can a deactivated email identity affect reprovisioning?",
    "What should procurement ask about identity and content removal?",
    "Which additional evidence is needed for an erasure claim?",
    "Can I save the source-bound offboarding distinction?",
    "When should SCIM authority be checked again?"
  ],
  "supported_claims": [
    {
      "claim": "Slack states that SCIM can deactivate users but cannot permanently delete them. Its token authority also depends on the generating account role. A deactivation result supports an identity-lifecycle claim, not a general data-erasure claim.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Slack states that SCIM can deactivate users but cannot permanently delete them. Its token authority also depends on the generating account role. A deactivation result supports an identity-lifecycle claim, not a general data-erasure claim.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-GITHUB-PUSH-BYPASS-01-v1",
    "VXI-EXT-PROCUREMENT-GITLAB-MASKING-01-v1",
    "VXI-EXT-PROCUREMENT-GCP-KEY-LIFECYCLE-01-v1",
    "VXI-EXT-PROCUREMENT-AWS-LAST-ACCESS-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Slack SCIM user deactivation and identity lifecycle",
    "source_url": "https://docs.slack.dev/admins/scim-api/",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-SLACK-SCIM-DEACTIVATION-01-v1",
    "candidate_record_sha256": "7969315855dbae68c5f322fadaed0b496e9a906d35963b6caedbb83b8b0a2782",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Slack states that SCIM can deactivate users but cannot permanently delete them. Its token authority also depends on the generating account role. A deactivation result supports an identity-lifecycle claim, not a general data-erasure claim.",
    "required_buyer_context": "Workspace or Enterprise organisation, identity, SCIM actor and desired offboarding outcome.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "SCIM offboarding permanently erases the user and their data.",
    "documented_statement": {
      "status": "documented",
      "statement": "Slack states that SCIM can deactivate users but cannot permanently delete them. Its token authority also depends on the generating account role. A deactivation result supports an identity-lifecycle claim, not a general data-erasure claim.",
      "source_ids": [
        "slack-scim"
      ]
    },
    "buyer_evidence_required": [
      "Identity and organisation scope of the offboarding result",
      "SCIM actor role and authority over the target user",
      "Separate evidence for any claimed content or personal-data deletion"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require separate erasure evidence when the requested outcome exceeds deactivation."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "slack-scim",
        "url": "https://docs.slack.dev/admins/scim-api/",
        "final_url": "https://docs.slack.dev/admins/scim-api/",
        "title": "Slack SCIM user deactivation and identity lifecycle",
        "checked_on": "2026-10-14",
        "sha256": "e401ff2176de7ff06f005d373f168fe9685fff47874cfc77e334258c16a19d29",
        "bytes": 52969
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Save the distinction between identity deactivation and data-erasure evidence.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck SCIM actor roles and the supplier deletion process."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#slack-scim-deactivation-erasure-evidence",
  "machine_readable_record": "/varexis-index/records/slack-scim-deactivation-erasure-evidence.json"
}