Removing unmanaged resources is currently done through the resources type:

resources { user: purge => true }

After multiple conversations about this fact (and the second one especially), it has been concluded that the better way to do this is to make the resources type behave more like a normal type, in that ensure would be the main attribute, with a second selection attribute, select, used to pick which resources are being managed. Most likely, only unspecified resources could be selected, else we would have a conflict, but it might make sense at some point to support selecting a subset of resources.