What should be preserved before blocking or removing access?¶

Capture the exact account, session, role or permission and its relationship to conversations, groups, files and connected services before selecting it.

Preserve identifiers and capability¶

Record service, username, handle, profile or provider ID, contact details, device or session, activity time, group, administrator role and permission level.

Capture the complete screen and warning explaining the effect. Retain partial values exactly and do not rely on duplicate display names.

Make removal reviewable¶

State the risk and alternatives. If action follows, record authority, operator, exact time, confirmation, audit reference and disappearance or alteration of the entry.

Keep capability, observed activity and personal attribution as separate propositions.