Architecture Decision Records

Decision. Each organization receives a dedicated database; the control plane stores routing metadata only. Tenant id filters remain as defense in depth.

Consequences. Strongest blast-radius containment and per-tenant restore/residency, at the cost of provisioning and migration orchestration.

Decision. Bounded contexts are separated by module, contract and event, deployed as one unit until scale demands extraction.

Consequences. Lower operational overhead now, with a clean extraction path later.

Decision. Cross-module interaction uses domain events, not direct table reads.

Consequences. Decoupling and auditability; requires idempotent consumers and a DLQ.

Decision. Permissions are resource.action.scope grants inside roles, refined by attribute scopes and field restrictions, always evaluated server side.

Consequences. Expressive least privilege; role builders must enforce delegation boundaries.

Decision. Every request is authenticated, tenant-resolved and authorized; no implicit trust for platform staff.

Consequences. More checks per request; predictable containment of compromise.

Decision. All model traffic is brokered with policy checks, redaction and output validation.

Consequences. Central control of AI risk; a single component to keep highly available.

Decision. Audit records are append-only at the database level; no interface can edit or delete them.

Consequences. Reliable forensic evidence; retention and storage growth must be managed.

Decision. Payroll approval and payment execution require separate principals with step-up authentication.

Consequences. Prevents single-actor fraud; requires staffing for both roles.

Decision. Documents live in object storage behind short-lived signed URLs; buckets are never exposed.

Consequences. Scalable and cheap storage; access control must live in the document service.

Decision. Reporting reads from replicas/warehouse via CDC, never from operational databases.

Consequences. Protects transactional latency; introduces eventual consistency in dashboards.