When PSPNG is provisioning an ldap attribute, it removes values as memberships and groups are deleted, however, the full-sync process will only delete unknown values that match a prefix. This only works completely if all the provisioned values have a common prefix.

When PSPNG has full control of the target attribute, then it should be configurable to delete all unknown values, regardless of prefix.

This should be configurable with:
changeLog.consumer.pspng_attributes.allProvisionedValuesPrefix=*