Takedown and Permission Change Checklist¶

Use this operational checklist when processing document takedowns, legal right-to-erasure requests, content withdrawals, or document-level access permission updates. Complete each section and attach the recorded verification evidence to the change or incident ticket before closing.

1. Request and Ticket Metadata¶

Ticket ID / Legal Notice: ${TICKET_ID}
Requester / Authority: ${REQUESTER_NAME}
Source Document URI(s): ${SOURCE_PATH}
Target Search Index: ${INDEX_NAME}
Compliance Deadline: ${TAKEDOWN_DEADLINE}
Selected Execution Path: Direct Deletion (Stage 2a) | Indexer-driven Deletion (Stage 2b) | Permission Resync (Stage 2c)
Assigned DevOps Engineer: ${DEVOPS_ENGINEER}
Assigned GenAI Engineer: ${GENAI_ENGINEER}

2. Pre-execution and Source State Checks¶

Ticket completeness verified: Ticket records ticket ID, requester name, exact source URI, chunk keys (if pre-identified), compliance deadline, and legal/business rationale.
Execution path decided: Compare ${TAKEDOWN_DEADLINE} with the scheduled indexer run interval (${INDEXER_SCHEDULE}). If the deadline is shorter than the schedule interval, if the data source has no deletion detection policy, or if the indexer uses a one-to-many parsing mode, select direct deletion (Stage 2a). Otherwise, select indexer-driven deletion (Stage 2b). For permission changes, select permission propagation (Stage 2c).
Current state recorded: The blob's metadata and its ACLs or group assignments are saved in the ticket, so they can be put back.
Native blob soft-delete applied: If using native soft-delete policy, verify the blob is deleted at source and moved to the soft-deleted container state in Azure Storage.
Custom metadata flag applied: If using custom metadata deletion policy, verify ${SOFT_DELETE_COLUMN} is set to ${SOFT_DELETE_MARKER} on the source blob. Do not delete the blob file until index purge is verified.
Source permissions updated: If handling an access restriction, verify the ACL, role assignment, or classification tag is updated on the source object in ADLS Gen2, Blob Storage, or SharePoint.

3. Index and Vector Purge Execution¶

Chunk identification (Direct deletion): List the keys where ${PARENT_FIELD} eq '${SOURCE_PATH}' with delete_by_source.py --dry-run, which deletes nothing. Confirm all listed chunk IDs strictly belong to the withdrawn document.
Batch deletion execution (Direct deletion): Delete exactly the listed keys with delete_by_source.py --keys-file, in batches of at most 1,000 documents. Confirm every item in the batch response yields statusCode: 200. For any HTTP 207 response, isolate failed keys, check error codes (e.g. 503 throttling or 422 unavailability), and retry.
On-demand indexer execution (Indexer deletion): Trigger indexer run via POST /indexers/${INDEXER_NAME}/run?api-version=2026-04-01. Confirm indexer execution finishes with status: "success" and itemsFailed: 0.
Security filter update (Application-managed ACLs): Save the current ${ACL_FIELD} lists first. Then update ${ACL_FIELD} in each child chunk with a merge action that sends the complete new list (a merge replaces the whole list), or re-index the parent document with updated group IDs.
Native ACL resync (ADLS Gen2 native permissions preview): Submit resync payload {"options": ["permissions"]} via snippets/ops/requests/resync-permissions.http. Run indexer twice: verify currentState.mode transitions through indexingResync back to indexingAllDocs.

4. Cache and Memory Invalidation¶

Answer cache purge: Invalidate all cached prompt responses, LLM completion cache entries, and semantic cache vectors linked to the purged document IDs.
Reverse proxy / CDN purge: Clear HTTP response caches on API Management, Front Door, or CDN layers for endpoints serving retrieval answers.
Conversation memory invalidation: Expire or terminate active conversational agent sessions and thread memories that received context chunks from the withdrawn file.

5. Post-execution Verification¶

Chunk lookup HTTP 404 verified: Execute direct document lookup for each deleted chunk key via GET /indexes/${INDEX_NAME}/docs('${CHUNK_KEY}')?api-version=2026-04-01. Confirm HTTP 404 Not Found for every key.
Parent filter query returns zero: Query index with filter=${PARENT_FIELD} eq '${SOURCE_PATH}'. Confirm @odata.count is 0 and results array is empty.
Access verified for both users (Permission changes): Limit the query to the changed file. Query as a user who lost access (with their group IDs, or their own token in x-ms-query-source-authorization for native ACLs); confirm zero chunks returned. Query as a user who kept access; confirm the chunks are still returned.
File deleted at source (Custom metadata policy): After the checks above pass, the flagged file is deleted in Azure Storage.
Next indexer run monitored: Observe subsequent scheduled indexer run. Confirm the withdrawn file is not reintroduced into the index.
Rollback procedure verified: In the event of an erroneous withdrawal, confirm the source file can be restored and re-indexed by re-saving its metadata and running the indexer, or via Reset Documents (preview 2026-08-01-preview).

6. Sign-off and Ticket Closure¶

Role	Name	Date (YYYY-MM-DD)	Notes
DevOps engineer	`${DEVOPS_ENGINEER}`	`YYYY-MM-DD`	Confirms: all index chunks purged and 404 confirmed
GenAI engineer	`${GENAI_ENGINEER}`	`YYYY-MM-DD`	Confirms: semantic and answer caches cleared
RAG Lead	`${RAG_LEAD}`	`YYYY-MM-DD`	Confirms: verification evidence attached to ticket