# Terraform workflow: safe destroy with a reviewed destroy plan
## When
Decommissioning an environment, removing an ephemeral workspace, tearing down a failed experiment. Never as a casual cleanup.
## Steps
1. `terraform plan -destroy -out=destroy.tfplan`. This is a full plan in destroy mode: every resource listed for deletion.
2. Review the destroy plan line by line. Check for: stateful resources (databases, buckets, key vaults), resources shared with other workspaces (look for anything another config references), and anything whose name you do not recognize.
3. Get explicit human approval for the destroy plan. This is the approval gate; the plan file is the artifact being approved.
4. Back up anything stateful first: snapshots, exports, bucket copies. "We can recreate it" is not a backup.
5. `terraform apply destroy.tfplan`. Watch it complete; do not walk away from a destroy.
## Rules for agents
1. Never `terraform destroy -auto-approve`. The flag exists; using it on destroy is never justified.
2. `-target` with destroy is for surgical removal of one resource, not for avoiding review. A targeted destroy still needs its own plan review.
3. If the destroy plan includes resources you did not expect, stop. Unexpected entries mean the config or workspace is not what you think; destroying first and asking later is irreversible.
4. After destroy, verify in the console that the critical resources are actually gone AND that nothing shared was affected. Then remove the workspace/config so nobody re-applies it by accident.