War-game a object lifecycle policy before age rules, legal-hold budgets, and rollback steps harden into what every object delete will quote.
Lifecycle policies fail when the runbook invents precision the rule engine never had, when hold lists dual-count the same prefix as deletable and as exempt, when money routes still lack a named false-delete owner, and when ops cannot show who owns the decision after a partial purge misfire. A neat lifecycle JSON dump is not evidence.
Freeze the change
One sentence for why the policy exists, which buckets and prefixes it covers, who owns age rules, logging, and rollback, and the abort trigger if false deletes or restore lag past a named threshold. Attach the draft policy, sample object logs, hold map, and the measured path from detection to restored objects. If storage, legal, and product disagree on which prefixes are truly covered, stop and reconcile first.
Name the decision you will make if the war game finds nothing new, and the delay criteria if any money path still lacks a named rollback owner or a verified canary.
Seats that matter
- Storage ops. Where age rules invent coverage or hide shared policies across apps.
- Legal. Where holds still leave the queue and become standing exceptions.
- Product. Which customer decision breaks first when a needed object is deleted.
- Support. How status language trails the customer-visible restore rate.
- Skeptic. The claim that looks strongest and is least evidenced by prior lifecycle drills.
Attach the same source pack to every seat. Secret holds for favorite partners only create fake calm.
Require a canary prefix with a measured delete-and-restore pass before any money path joins the policy. If the canary still depends on a verbal hold list, keep the change in hold.
Loop the review
Feed Pingpong the draft policy, canary notes, and open risk list. Early passes steelman the design. Later passes attack from storage, legal, product, support, and skeptic seats. End with a pass that turns surviving objections into clearer owners, a timed canary, or a hold. Delete invented "we already purge cleanly" claims and dual-counted success rates.
Force a month-after narrative: what happens if a partner invoice object is deleted, if a marketing asset starts failing restore checks, or if an operator widens a hold under launch pressure. If those stories are stronger than your mitigation plan, fix the package before you ship the policy.
Pair with the storage ops lead seat, a backup retention ladder review, a data retention policy stress test, and the war-game decisions hub.