03.02 · Concept
The User Lifecycle State Machine
Draw the states a user moves through - anonymous, registered, verified, active, dormant, suspended, deleted - and name what each transition must do to sessions and grants.
A user lifecycle state machine makes account changes explicit: which states exist, which transitions are allowed, and what each transition does to sessions, tokens, API keys, OAuth grants, roles, entitlements, caches and audit records. It prevents access from surviving after an account is suspended, deleted or otherwise downgraded.
What this lesson answers
- how should user lifecycle states be modelled
- what happens to sessions when users are suspended
- difference between identity state and access state
Notes
A user lifecycle state machine is a way to make account behavior explicit instead of scattering it across signup code, login checks, billing jobs, admin tools, and support scripts. Each user is in one main state, such as anonymous, registered, verified, active, dormant, suspended, or deleted, and every transition between states has required side effects. Those side effects usually include what happens to sessions, refresh tokens, API keys, OAuth grants, device registrations, roles, entitlements, and audit records.
The useful mental model is that identity state and access state are related but…
References
Common questions
- Why is a user state machine better than a status flag?
- A single status flag hides the real security work. Account access can live in sessions, refresh tokens, API keys, OAuth grants, cached permissions and service entitlements. A state machine forces every account transition to define whether those access paths are preserved, expired, revoked, rotated, blocked or audited.
- What should happen when a user is suspended?
- Suspension should block new authentication and make existing access unusable. In practice that means revoking or ignoring active sessions, refresh tokens, API keys and grants, while keeping enough account and audit data to explain the action, support review, and avoid accidentally re-enabling access through another service.
- How is a dormant user different from a deleted user?
- A dormant user still has an account and may be allowed back after reauthentication, risk checks or step-up verification. A deleted user should no longer be able to authenticate. Deletion also starts data retention, erasure or anonymisation handling, depending on the product’s privacy and compliance rules.
Short definition: what is User Lifecycle State Machine?