This rule detects critical organization-level deletion activity within Anthropic’s GenAI platform by monitoring Anthropic Audit Logs for specific administrative actions that purge tenant data, projects, and member access. It triggers when the anthropic.audit data stream contains a configuration-related event with actions: org_deletion_requested, org_bulk_delete_initiated, or org_deleted_via_bulk, within a recent window of the last 9 minutes. The rule maps to MITRE ATT&CK: Data Destruction (T1485) and Account Access Removal (T1531) under the Impact tactic (TA0040). It assigns a high risk_score of 99 and a critical severity. Investigation fields are prepared to extract the timestamp, action, organization, actor identity (user/email/ID), source IP, and user agent, enabling rapid triage of unauthorized vs. legitimate offboarding.