# Record lifecycle and danger zones

Consequential actions belong after the normal Edit form and its Save controls. Separate reversible record-management actions from irreversible destruction.

## Record lifecycle

Use **Record lifecycle** for actions that remove an item from normal use but can be reversed, including Archive, Deactivate, and Restore.

- Use exact labels such as `Archive asset` or `Deactivate user`.
- Explain the immediate effect and state whether restoration is possible.
- Use a neutral outlined button in the resting page section.
- Confirm when the action meaningfully changes availability, automation, or access.
- Use a neutral primary confirmation unless product risk requires stronger emphasis.

Restore is a lifecycle action, not a danger action. It can appear in the same section when the archived state is being edited.

## Danger zone

Use **Danger zone** only for irreversible or exceptionally high-impact actions, including permanent deletion, permanent revocation, or removal of dependent history.

- Keep the panel neutral; red is reserved for the destructive action.
- Use an outlined danger button on the resting page.
- Open a confirmation modal and use a filled danger button for the final action.
- State the affected object and the data or access that will be lost.
- Use typed confirmation only for unusually broad or high-impact deletion.

## Language

The title, description, button, confirmation title, and submitted operation must describe the same action. `Delete asset` cannot be paired with copy that says the record will be archived. If the record can be restored, prefer `Archive asset`.

Avoid generic labels such as `Delete`, `Proceed`, or `Confirm`. Use `Delete asset`, `Revoke access`, or another explicit verb-object pair.

## Placement and permissions

- Place the section at the bottom of Edit or Settings pages.
- Never mix these actions into the normal Save/Cancel row.
- Render only actions permitted for the current user.
- A disabled action is appropriate only when explaining its unavailability helps the user complete the task.
- Preserve layout when an action enters a processing state and block duplicate submission.

## Confirmation behavior

1. Move focus into the modal and trap it while open.
2. Put Cancel before the destructive confirmation in reading order.
3. Let Escape close the modal before submission.
4. Return focus to the initiating button after cancellation.
5. Do not auto-dismiss an error raised by the destructive operation.