An exercise in reading a requirement
“It’s a button.”
Take the most ordinary requirement there is: a “Delete my account” button in settings. Read by one person, it is a confirm dialog and a deleted row. This exercise reads it from the side of everyone it affects — which is the only way to see what a well-designed version of it has to do.
Guess first, then see how close you were. None of what follows is in the sentence you would have typed.
- Guess how many systems it touches, then press it
- Hear from everyone who will judge it
- Sort what each of them expects
- Find where their expectations collide
- Compare your guess with the answer
Most people say three. Three is what it looks like.
Danger zone
Permanently delete this account and everything in it.
Step 2 of 5 · Every perspective
Then you ask everyone else.
“I clicked delete. I want it gone, I want to stop paying today, and I do not want to talk to anyone about it.”
- The person leaving — Signed up in 2023. Done now. “I clicked delete. I want it gone, I want to stop paying today, and I do not want to talk to anyone about it.”
- Their colleague — Three desks over. Never clicked anything. “They owned the workspace I work in every day. If their account goes, does my Monday go with it?”
- Support lead — Will hear about this first. “Before they go I need to know why — and for a while after, I need to be able to bring them back when they email us in a panic.”
- Data protection officer — Answers to a regulator, not to you. “Within thirty days every copy has to be gone — replicas, backups, the warehouse — and I need a receipt that proves it.”
- Counsel — Appears only when it is already too late. “If there is an open dispute, that account is evidence and it is under hold. Deletion is not available.”
- Revenue accounting — Closes the books every quarter. “Their invoices are statutory records. I am required to keep them for seven years, whatever they just clicked.”
- Security engineer — Assumes the session is stolen. “I need to know who deleted what and from where — which is a record about the person we just promised to hold no record of.”
- Trust and safety — Bans forty accounts a week. “If deleting your account is how you shed a ban, we have shipped a self-service ban eraser.”
- The on-call engineer — Carries the pager this week. “It is four million rows across nine services. If that runs synchronously behind a button, I am the one awake at 3am.”
- Analytics engineer — Owns the numbers the board has seen. “Take them out of the warehouse and last quarter changes. Every dashboard we have already shown the board silently rewrites itself.”
- ML engineer — Shipped a model in March. “Their data is already inside a model we shipped. You cannot delete a row out of a set of weights.”
- Lifecycle marketing — Has a campaign running. “Four emails are already queued for them. Sending one after they have left is the worst message we will ever send.”
Step 3 of 5 · What each of them expects
The same thirty-four, sorted three ways.
- Functional
- Non-functional
- Evidentiary
Twelve people. The on-call engineer wants it to resume from service six; the data protection officer wants every copy gone in thirty days. Both are right.
Every dot is one expectation somebody is holding. Touch one to see who is holding it, when it bites, and what it forces you to build.
- The person leaving: When I click delete, it deletes — and the charging stops today, not at the end of the cycle. Forces: Cross-service erasure.
- The person leaving: Ten seconds to realise I hit the wrong thing, without having to email a human about it. Forces: Confirmation, grace and restore.
- The person leaving: I do this by keyboard alone, and nothing in the confirmation depends on my seeing a colour. Forces: Confirmation, grace and restore.
- The person leaving: Tell me it is actually gone. Show me — do not reassure me. Forces: Tamper-evident deletion ledger.
- Their colleague: They owned the workspace I work in. My Monday should not end with their account. Forces: Ownership handover.
- Their colleague: Somebody tell me before it happens, not after I find the door locked. Forces: Ownership handover.
- Support lead: Thirty days to bring them back, because a third of them write to us in week two. Forces: Confirmation, grace and restore.
- Support lead: Ask why they are leaving. It is the only churn signal we will ever get from them. Forces: Warehouse tombstoning.
- Support lead: When it half-works, I need to see exactly where it stopped before I answer them. Forces: Deletion orchestrator.
- Data protection officer: Within thirty days, every copy: replicas, backups, the warehouse, the exports. Forces: Backup and replica reconciliation.
- Data protection officer: "Everything" has to be a list somebody wrote down, field by field, not a hope. Forces: Retention and lawful basis.
- Data protection officer: A receipt that proves it, on a regulator’s timeline rather than on ours. Forces: Tamper-evident deletion ledger.
- Data protection officer: Four processors hold their data under our name. They have to hear about this too. Forces: Cross-service erasure.
- Counsel: If there is an open dispute, that account is evidence. Deletion is not available. Forces: Legal hold registry.
- Counsel: And years later I have to be able to show why we refused, and who decided. Forces: Legal hold registry.
- Revenue accounting: Their invoices are statutory records. Seven years, whatever they just clicked. Forces: Retention and lawful basis.
- Revenue accounting: There is an unpaid invoice. Deleting the account does not delete the debt. Forces: Deletion orchestrator.
- Revenue accounting: Last year’s books have to reconcile after the deletion exactly as they did before it. Forces: Warehouse tombstoning.
- Security engineer: Who deleted what, from where, on which session, at what time. Forces: Tamper-evident deletion ledger.
- Security engineer: A stolen session must not be able to do this. Re-authenticate, every time. Forces: Confirmation, grace and restore.
- Security engineer: And the trail has to be one that nobody here can quietly edit afterwards. Forces: Tamper-evident deletion ledger.
- Trust and safety: A banned account must not be able to launder itself clean by deleting and returning. Forces: Identity tombstone.
- Trust and safety: Keep the fingerprint. Lose the person. Both of those are the same row today. Forces: Identity tombstone.
- The on-call engineer: Four million rows across nine services. Not synchronously, behind a button. Forces: Deletion orchestrator.
- The on-call engineer: It will fail on service six. It has to resume from six, not start again at one. Forces: Deletion orchestrator.
- The on-call engineer: Running it twice has to equal running it once, or the retry becomes the incident. Forces: Cross-service erasure.
- The on-call engineer: When it stalls at 3am, whoever is awake needs to know which of the nine is stuck. Forces: Deletion orchestrator.
- Analytics engineer: Take them out and last quarter changes. The board has already seen last quarter. Forces: Warehouse tombstoning.
- Analytics engineer: Cohorts have to stay countable after the people inside them are gone. Forces: Warehouse tombstoning.
- Analytics engineer: Every downstream table that ever touched them — and I have to be able to name them. Forces: Warehouse tombstoning.
- ML engineer: Their data is inside a model we shipped. You cannot delete a row out of a set of weights. Forces: Model influence register.
- ML engineer: So at minimum: which models saw them, and when each one was last retrained. Forces: Model influence register.
- Lifecycle marketing: Four emails are already queued. One arriving after they leave is the worst we will send. Forces: Outbound suppression.
- Lifecycle marketing: And two ad platforms have their address in an audience we uploaded last week. Forces: Outbound suppression.
Step 4 of 5 · Where perspectives collide
Four of these cancel each other out. Both sides are binding, and somebody has to choose.
Four of the thirty-four cannot be satisfied at the same time as another. None of them is a bug, and none of them has a technically correct answer.
01 Erase everything / keep it seven years
“Within thirty days, every copy: replicas, backups, the warehouse, the exports.”
“Their invoices are statutory records. Seven years, whatever they just clicked.”
Both are true. Both are law. One says every copy of them is gone in thirty days; the other says their invoices are financial records you are not permitted to destroy.
Somebody has to write down, field by field, which of their rows is a financial record and which is a person. That line is a product decision wearing a legal costume, and it has to exist before the first deletion — not after the first complaint.
02 Hold no record / hold a record of holding none
“Within thirty days, every copy: replicas, backups, the warehouse, the exports.”
“Who deleted what, from where, on which session, at what time.”
Both are true. The receipt that proves you forgot someone is itself a record about them. You cannot satisfy the auditor without writing down the thing you promised not to write down.
Decide, in advance, what counts as enough proof without re-identification — a one-way hash, a time, a scope, and nothing that points back. In advance is the only option available: evidence is captured as it happens or it never exists at all.
03 Gone today / recoverable for a month
“When I click delete, it deletes — and the charging stops today, not at the end of the cycle.”
“Thirty days to bring them back, because a third of them write to us in week two.”
Both are true. The person means it. A third of them will also write to you in week two meaning the opposite, and support is the one who has to answer.
The answer is a number, and the number is a belief about your users rather than a technical constant. Whoever picks it has decided how much regret you are willing to absorb on somebody else’s behalf.
04 Out of the warehouse / last quarter must not move
“Within thirty days, every copy: replicas, backups, the warehouse, the exports.”
“Take them out and last quarter changes. The board has already seen last quarter.”
Both are true. Erasure reaches analytics like it reaches everything else. But a revenue number the board saw in January cannot quietly become a different number in March.
Rows leave and totals freeze — which means every historical metric needs a point-in-time contract, designed before the first deletion rather than discovered during the first audit.
Step 5 of 5 · Your guess, answered
34 expectations. 12 systems.
And 10 of the 34 do not ask you to do anything at all. They ask you to prove, later, that you did — which is a system you build in advance or never, because evidence is captured as it happens or it does not exist.
Deletion orchestrator
A durable, resumable, idempotent workflow. Not a request handler behind a button.
5expectationsWarehouse tombstoning
Rows leave. Last quarter does not move. Both, at once, forever.
5expectationsTamper-evident deletion ledger
The receipt. Proof that survives an auditor without re-identifying the erased.
4expectationsConfirmation, grace and restore
Ten seconds to change their mind. Thirty days to email you about it.
4expectationsCross-service erasure
Nine services, four processors, and no two of them agree on what a user is.
3expectationsRetention and lawful basis
The line between "personal data" and "financial record", written down field by field.
2expectationsLegal hold registry
The switch that makes deletion unavailable, and the reason it was thrown.
2expectationsIdentity tombstone
They are gone. The fact that this address was once banned is not.
2expectationsOwnership handover
What becomes of the things they owned that other people use every day.
2expectationsOutbound suppression
Every queued message stopped, across four channels you do not control.
2expectationsModel influence register
Which shipped models saw them, and what you intend to do about that.
2expectationsBackup and replica reconciliation
Erasure that reaches the copies you made on purpose, on a schedule you did not choose.
1expectation
Two of these were in the brief: delete the account, and put it in settings. The other 32 walked in afterwards, one at a time, each carried by somebody who was not in the room when the work was scoped.
That is the exercise. A requirement is only understood once it has been read from the side of every person it affects — and a well-designed system is one where each of their expectations was answered on purpose, not by default.
What the exercise shows
The button was never the hard part. Reading it from every side was.
Every requirement looks this way once you ask who it affects. The person leaving, the colleague whose Monday depends on them, the data protection officer, counsel, revenue accounting, trust and safety, the engineer carrying the pager — each will judge the same button on something different, and a well-designed system answers every one of them on purpose. That is what building with Cisely changes: the stakeholders and what each of them expects are written down once, and every piece of work is traced to the expectations it serves, where your engineers and your coding agents both read them.
Skip that step and the work still gets done. Any AI coding agent will write this button in twenty minutes. It will compile, the tests will pass, and the button will delete the user. It will not check the legal hold registry, so the two per cent of accounts that are evidence in an open matter will be deleted along with the rest. It will not ask which of the sixty fields are financial records you are required to keep for seven years. It decides all of it anyway, in about four seconds, by doing whatever it has seen done most often. Give the same agent the room, and it ships just as fast, stops at the legal hold, and refuses to destroy the invoices.
Then it has to survive contact with time. A new regulation lands. A tenth service joins. The engineer who knew about the legal hold leaves. Because every system on this page is tied to the expectation that forced it, what a change breaks is a question somebody can ask — instead of something you find out from a customer.
Get started
Write the room down once.
Cisely is where the expectations live — every stakeholder, every moment, every thing they will judge you on — in one place your people and your coding agents both read.
Not starting today?
No newsletter. One email, when there is something to see.