Why 'delete' is the wrong default for operational records
In a service business, the records people most want to tidy away are the ones with the longest tail of consequence: an old lead that resurfaces, an estimate that was declined and then revived, a job that becomes a warranty claim two years later. Destroying them to clean a list trades a moment of neatness for the permanent loss of the only account of what happened.
The four operations and what each one guarantees
- Soft delete: removed from every active view, still stored, still recoverable, still present in history.
- Archive: intentionally out of the working set but retrievable by anyone who looks, typically for completed or dormant work.
- Restore: returned to active use with its identity, relationships and history intact.
- Purge: irreversible destruction, appropriate for erasure obligations and for genuine mistakes, and for very little else.
The failure that makes soft delete worthless
A soft delete only works if the exclusion is universal. One report, one export, one automation or one search that forgets the exclusion and the deleted record reappears — often in front of a customer. The filter belongs in shared query paths and policies rather than being reapplied by hand at every call site.
Who is allowed to destroy something
Hiding a record and destroying one are not the same authority. Soft delete can reasonably belong to the people doing the work; purge should sit with a senior role, be recorded with actor and reason, and be resistant to being performed casually from a list view.