AO coverage. Addresses both Identifier Reuse objectives: the non-reuse period is defined, and reuse is prevented within it.

Defined period. Account identifiers (UPN, sAMAccountName, MES user ID, and employee number) cannot be reused for 24 months after the account is deleted. Mail aliases are stricter: never reused, because misdirected mail is the failure mode we actually saw.

Enforcement. Deletion writes a tombstone row to an identifier reservation table with the retire date. The provisioning workflow checks that table before it will create anything, and a candidate identifier that collides gets a numeric suffix rather than the retired string. Rehires get their original identifier back only when the reservation row maps to the same HR person record — same identifier, same human, no ambiguity in old audit records.

Why it matters here. With this much churn, log entries from two years ago must still resolve to one person. The reservation table is exported with the audit archive so an investigator reading old records can resolve an identifier that no longer exists in the directory.

Maintenance. Quarterly negative test: attempt to provision an identifier retired within the window and confirm the workflow refuses. Annual review of table growth and of the 24-month figure against the audit retention period (the hold must not be shorter than retention).

Accepted gap. The shop MES caps user IDs at eight characters, so collisions are frequent and suffixes get ugly. The reservation table covers MES IDs too, and the suffix pattern is documented; the alternative — reusing short IDs — was rejected.

• Written identifier reuse policy stating the 24-month period and the alias rule
• Reservation table schema and a sample export with retire dates
• Provisioning workflow logic or code path showing the collision check
• Quarterly negative-test ticket showing provisioning refused a retired identifier