# Stage inputs

The staged PowerShell runner calculates globally unique names locally from the chosen subscription and writes them only to `work/runtime.json`, which is ignored and never packaged. It passes these stage inputs to the subscription-scoped Bicep template:

| Stage | `includeDetachableIdentity` | Stack deny mode | Action on unmanage | Stack-controlled `Lifecycle` tag |
| --- | --- | --- | --- | --- |
| Deploy | `true` | `none` | `detachAll` | `Foundation` |
| Protect | `true` | `denyDelete` | `detachAll` | `Protected` |
| Enforce | `true` | `denyWriteAndDelete` | `detachAll` | `Enforced` |
| Detach | `false` | `denyWriteAndDelete` | `detachAll` | `Enforced` |

`detachAll` affects only resources removed from the desired template. Cleanup removes the detached identity explicitly and deletes all remaining stack-managed resources with `deleteAll`.
