Modern security assumes identity retention is unavoidable.
We design systems that verify who someone is, store that identity, replicate it across environments, audit it for years, insure it against loss, and then build entire security programs around protecting it indefinitely. This pattern is so normalized that it rarely gets questioned.
If a system ever verifies identity, eligibility, or authorization — this concerns it.
Most modern systems are not built to remember people. They are built to make decisions. And that distinction matters.