A pending deletion state is a temporary lifecycle phase where a cloud project or resource is scheduled for removal but has not yet been fully purged. That window can create security ambiguity if access artifacts remain usable or inconsistently visible. Governance should ensure lifecycle transitions also trigger access cleanup and user-facing revocation visibility.
Expanded Definition
Pending deletion state describes a lifecycle interval in which a cloud project, service, or resource has been marked for removal but is not yet fully purged. In NHI governance, that distinction matters because control-plane visibility can persist while data-plane access still works, leaving service accounts, API keys, certificates, and automation tokens in a liminal state. The concept is adjacent to deprovisioning, but it is not the same as revocation: deprovisioning should remove or disable access, while pending deletion is only the transitional period before purge. Under NIST Cybersecurity Framework 2.0, this kind of transition should be handled as part of access governance and asset lifecycle discipline. Usage in the industry is still evolving, and different cloud platforms expose different retention windows, recovery options, and visibility states. NHI Management Group treats pending deletion as a governance checkpoint, not a housekeeping label. The most common misapplication is assuming deletion has already removed access when the resource is only marked for removal, which occurs when cleanup workflows do not trigger immediately at lifecycle change.
Examples and Use Cases
Implementing pending-deletion handling rigorously often introduces operational friction, because teams must weigh recovery flexibility against the risk of residual access.
- A cloud project is deleted by a platform admin, but its linked service account remains visible for a short retention period and must be explicitly disabled before purge.
- An API key is attached to a resource scheduled for deletion, and automation continues to call the endpoint until the key is revoked during the transition window.
- A certificate-backed workload is moved into pending deletion, requiring the security team to confirm that renewal jobs, trust stores, and secret references are removed in parallel.
- A development environment is soft-deleted for cost control, but access reviews must still verify that privileged tokens tied to it are no longer accepted.
This pattern is closely related to lifecycle hygiene described in Ultimate Guide to NHIs, where offboarding and revocation are treated as separate control steps, and it aligns with the practical identity lifecycle emphasis in NIST Cybersecurity Framework 2.0.
Why It Matters in NHI Security
Pending deletion state becomes a security issue when teams mistake “scheduled for removal” for “no longer usable.” That gap can leave secrets, credentials, and automation paths active after the business believes a workload is gone. NHI Management Group data shows that only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, which makes transition windows especially dangerous when deletion workflows are inconsistent. The risk is not limited to obvious production assets; ephemeral projects, test tenants, and temporary integrations often have the weakest lifecycle controls and the least monitoring. A pending deletion state should therefore trigger revocation, inventory updates, access review, and confirmation that user-facing visibility matches actual enforcement. The operational failure mode is often silent: the platform shows removal in progress, while downstream tools still trust the old identity artifact. Organisational exposure is also amplified when deletion is used as a substitute for cleanup, a pattern discussed in the Ultimate Guide to NHIs, which notes that 91.6% of secrets remain valid five days after notification of compromise. Organisations typically encounter this consequence only after an unexpected access event or audit finding, at which point pending deletion state becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers NHI lifecycle gaps that leave credentials usable during deprovisioning. |
| NIST CSF 2.0 | PR.AC-4 | Access permissions must be managed through the full identity lifecycle, including removal states. |
| NIST Zero Trust (SP 800-207) | SCG-1 | Zero Trust requires continuous enforcement, not trust carried over from a soon-to-be-deleted resource. |
| NIST SP 800-63 | Identity proofing and authenticator lifecycle concepts inform secure retirement of machine credentials. | |
| CSA MAESTRO | Agentic systems must lose tool access promptly when their backing resource enters removal state. |
Tie asset deletion to access review and confirm permissions are removed before the resource disappears.
Related resources from NHI Mgmt Group
- What breaks when delegation revocation is not tied to client deletion?
- Who is accountable when an AI agent exposes credentials or changes identity state?
- How should security teams implement state, nonce, and PKCE together in OIDC flows?
- What breaks when teams rely on system state restore for identity servers?
