State machines

State transitions are commands with authorization, preconditions, resource version, reason and audit. Direct database state edits are unsupported.

stateDiagram-v2
  [*] --> Requested
  Requested --> Granted: affirmative action
  Requested --> Denied: decline
  Requested --> Cancelled: abandoned/invalid
  Granted --> Withdrawn: comparable route
  Granted --> Expired: configured lawful expiry
  Withdrawn --> [*]
  Denied --> [*]
  Cancelled --> [*]
  Expired --> [*]

A new grant after withdrawal creates a new receipt against the current notice; it does not reopen or mutate the old grant.

Rights/grievance case

stateDiagram-v2
  [*] --> Submitted
  Submitted --> IdentityPending
  IdentityPending --> Triaged: verified
  IdentityPending --> Rejected: failed with review
  Triaged --> Clarification: needed
  Clarification --> Triaged: received
  Triaged --> InFulfilment
  InFulfilment --> ReviewPending
  ReviewPending --> Delivered: complete
  ReviewPending --> PartiallyFulfilled
  ReviewPending --> Refused: approved reason
  Delivered --> Closed
  PartiallyFulfilled --> Closed
  Refused --> Closed
  Closed --> Reopened: new evidence/failure
  Reopened --> InFulfilment

Cancellation stops pending tasks where possible but retains evidence. A connector failure cannot transition directly to Refused.

Deletion job

stateDiagram-v2
  [*] --> Planned
  Planned --> BlockedByHold
  BlockedByHold --> Planned: hold released / recalculate
  Planned --> ApprovalPending
  ApprovalPending --> Running: maker-checker
  Running --> Verified: all destinations proven
  Running --> Partial: exception or failure
  Partial --> Running: retry/reconcile
  Running --> Failed: unrecoverable / review
  Verified --> Certified
  Certified --> [*]

Only Verified can become a complete certificate. Partial may create a partial certificate with exceptions.

Incident

stateDiagram-v2
  [*] --> Reported
  Reported --> Triage
  Triage --> FalsePositive: reviewed
  Triage --> Active
  Active --> Contained
  Active --> NotificationActive
  Contained --> NotificationActive
  NotificationActive --> Remediating
  Remediating --> ClosureReview
  ClosureReview --> Closed: two-person approval
  Closed --> Reopened: new facts/recurrence
  Reopened --> Active

Clocks are child aggregates and remain active independent of incident severity/state until submitted, determined inapplicable or explicitly closed with authority.

Vendor/processor

stateDiagram-v2
  [*] --> Prospect
  Prospect --> DueDiligence
  DueDiligence --> Approved
  DueDiligence --> Rejected
  Approved --> Active: contract effective
  Active --> Restricted: finding/expiry
  Restricted --> Active: remediation
  Active --> Exiting
  Restricted --> Exiting
  Exiting --> Exited: export/deletion verified

Country, subprocessor, service or data-scope changes reopen the affected assessment without rewriting historic approval.

Processor propagation

sequenceDiagram
  participant C as Consent / case / deletion module
  participant O as Transactional outbox
  participant W as Orchestration worker
  participant A as Customer connector agent
  participant S as Processor / system
  participant R as Reconciliation
  C->>O: commit instruction + event atomically
  O->>W: at-least-once delivery
  W->>A: signed scoped instruction, expiry, idempotency key
  A->>S: destination-specific action
  alt acknowledged and verified
    S-->>A: outcome + destination reference
    A-->>W: signed minimal result
    W->>R: complete destination task
  else definite retryable failure
    S-->>A: bounded error
    A-->>W: retryable result
    W->>R: backoff, retry, then dead letter
  else ambiguous destructive timeout
    A-->>W: outcome unknown
    W->>R: stop blind retry; verify or route to human
  end
  R-->>C: aggregate complete / partial / failed

Ordering is per aggregate and destination. Successful destinations are never rolled back because another destination failed; the parent remains partial until exception, retry or manual reconciliation is approved.

Onboarding

stateDiagram-v2
  [*] --> Trial
  Trial --> Provisioned: domain and review
  Provisioned --> Configuring
  Configuring --> ReviewPending
  ReviewPending --> Configuring: changes requested
  ReviewPending --> Approved: maker-checker
  Approved --> Live
  Live --> Suspended
  Suspended --> Live: reviewed recovery
  Live --> Offboarding
  Offboarding --> Deleted: verified completion

Transition envelope

{
  "command_id": "cmd_synthetic_01",
  "aggregate_type": "rights_request",
  "aggregate_id": "rr_synthetic_01",
  "from": "review_pending",
  "to": "delivered",
  "expected_version": 12,
  "reason_code": "RESPONSE_APPROVED",
  "actor": "user_synthetic_reviewer",
  "occurred_at": "2026-07-29T17:00:00+05:30"
}

Invalid transitions return 409 INVALID_STATE_TRANSITION and the current safe state.