State model
Append-only case events feed a current-state projection. Evidence rows keep source, observation time, validity, correction history and narrative usage.
Roles, teams and systems evolve, leaving permissions that are individually explainable but collectively excessive or conflicting.
An identity graph compares current access with role, task and historical approval context, then produces evidence-bound revocation candidates.
Organisations, systems and operating conditions are intentionally anonymised and recomposed. The design demonstrates engineering and banking-domain reasoning; it does not represent a named client estate, vendor product or measured production result.
Typed commands, state changes and receipts cross an event spine without surrendering domain ownership.
Permitted workThe system may correlate events and propose recovery. Production change, privileged access and incident command remain controlled human authorities.
Consistency ruleCorrelate telemetry by service, version, environment and event time; configuration inventory is qualified, not assumed current.
Hard boundaryThe model is not a system of record, identity provider, policy authority or proof that an external effect occurred.
An alert or case requires evidence fan-out, deterministic triage, residual model reasoning and a defensible human disposition.
The model cannot revoke access or infer job need; every recommendation requires accountable-owner review.
A deterministic outer workflow contains model-led work inside typed, observable calls. Dashed messages remain proposals until policy or a human grants authority.
Append-only case events feed a current-state projection. Evidence rows keep source, observation time, validity, correction history and narrative usage.
Use asynchronous ingestion and bounded parallel reads. Slow providers have independent timeout and circuit-breaker policy so one source cannot exhaust the case tier.
Pin policy and evidence versions at case open. Later corrections append and may trigger reassessment; they do not rewrite the historic basis silently.
These roles are deliberately vendor-neutral. Each can be independently owned, versioned and replaced.
Returns candidate entities and typed relationships with match features, contradictions, effective dates and non-merge evidence.
Evaluates identity, purpose, capability, amount, risk tier and policy version; returns allow, deny, step-up or human-review with reasons.
Chooses an approved model route by task, risk, evidence quality, latency budget and cost ceiling; enforces structured outputs.
Presents claims beside evidence, alternatives, uncertainty, missing information, permitted actions and current custody.
Appends request, versions, policy result, model proposal, approval, action receipt, readback, correction and custody events under one correlation key.
Durable records carry provenance, authority, effect and custody without turning a transcript into an uncontrolled memory store.
Correlate telemetry by service, version, environment and event time; configuration inventory is qualified, not assumed current.
The selected design is not universally superior. It is the safer fit for this boundary and failure cost.
Bias consequential journeys against false merge and retain unresolved candidates.
Automatically merge the highest-scoring candidate.
Cost acceptedMore cases require clarification, but one person's authority or risk cannot silently attach to another.
Compile stable decision logic and retain retrieval for explanation and residual ambiguity.
Ask a model to interpret the source document for every request.
Cost acceptedRule compilation needs controlled change, but creates repeatable decisions, regression tests and clear exceptions.
Reserve larger models for residual reasoning after deterministic and smaller-model gates.
Send every request to the most capable available model.
Cost acceptedRouting adds evaluation work and operational complexity, but controls cost, latency and unnecessary data exposure.
Keep people at irreversible, ambiguous and policy-exception points; sample lower-risk automated outcomes independently.
Require the same manual approval at every step.
Cost acceptedRisk-tiering reduces review load but needs calibrated thresholds, sampling and immediate withdrawal of authority when drift appears.
Use append-only events plus a rebuildable current-state projection.
Overwrite the case row with its latest status.
Cost acceptedReplay and storage are more complex, but point-in-time reconstruction and correction lineage remain possible.
Retries are bounded by knowledge of business effect; unknown outcome remains visible, owned and independently reconciled.
Actual thresholds belong to accountable service owners. The design exposes the equations and observables that those owners must baseline.
peak_enrichment_qps = peak_case_rate x sources_per_casereview_hours = residual_cases / investigator_throughputevidence_storage = cases x evidence_rows x retention_windowRedact secrets and customer payloads from traces while retaining identity, change and evidence metadata.
A design is production-ready only when teams can prove what happened, recover it and change it safely.
failure injection and blast-radius test
rollback and schema compatibility
privileged-action approval
incident timeline reconstruction
Entitlement source, role mapping, approval lineage, usage context, conflict rules, owner decision and revocation receipt.
Line managers and access owners approve retention or removal.
Use shadow decisions and blind samples before allowing deterministic closes. Keep agent-touched cases under human disposition until operating evidence supports narrower review.
Service, SRE, security, change, architecture and business-continuity owners accept recovery choices.