Erasure
Remove the record of what was done under one address.
Documents in the mirror
not builtErasing above removes the record of what Kenward did. It does not remove the documents Kenward mirrored from your sources, and those are where a person's mail, files and messages actually sit.
Nothing records which documents are about a person. A document carries who may see it, which is a different question: erasing on that basis would delete other people's records and still miss the ones that name the person and were never shared with them. Guessing is worse than not offering it.
Disconnecting a source stops Kenward reading anything further from it and leaves what it already mirrored in place. Removing those documents is a separate thing that this product cannot honestly do yet.
Nothing gates this by role, because there are no roles: anyone who can reach this workspace can run it. Both phases, asking and erasing, land on the tamper evident record (the audit chain) either way, so an erasure always has a name attached to it.