Job flow 10 · task:admin-membership-expiry Diagram

Queued by: a super admin joining a customer's subscription as a hidden member for N hours (admin-membership controller; refused for EXPIRED or DISCARDED subscriptions). The expiry job is queued before any access is granted, so a failure to queue grants nothing. Job ID admin-member-expiry-<adminUser>-<sub>; an earlier one for the same pair is replaced.
Remove membership: deletes siem_auths rows for that admin user and subscription with isAdminMember true.
Detach owner policy: removes the admin user's link to that subscription's Tenant-Owner-Default policy.
Delete boundaries: deletes every IAM user boundary of the admin user, not only those for this subscription (errors ignored).
Reset workspace: if the admin's currentSubscriptionId is this subscription, it moves to another active membership or null. Then IAM and auth caches are cleared so access ends at once.