Jobs Worker Retention And Data Lifecycle

Purpose

This functional area applies scheduled data retention rules.

Main Capabilities

• governance audit retention
• inactive refresh-token session cleanup
• device flow session expiry and purge
• scheduled cleanup execution

How It Works

Each nightly run applies retention rules in a single database transaction. The specific activities are:

Governance audit records — records older than the configured audit retention window are deleted.

Refresh token sessions — inactive sessions (expired and not revoked within the retention window, or revoked and past the retention window) are deleted.

Device flow sessions — sessions that are still in a Pending state but whose expiry time has passed are first transitioned to Expired status. Then all terminal sessions — whether Expired, Denied, or Approved — that were last updated more than the configured device flow retention window ago are deleted.

The device flow cleanup runs in two phases within the same transaction: stale Pending sessions are marked Expired in memory, and then old terminal sessions (queried from the database before the current run's changes are committed) are removed. This ensures that sessions just now expiring are not immediately purged in the same run.

Functional Value

This area helps the platform control data growth and maintain operational hygiene over time. Without it, device flow sessions from abandoned authentication attempts would accumulate alongside old audit and token records.