Deliverables

flowchart LR
  subgraph cust["Customer"]
    direction TB
    c1(["Submits claim"])
  end
  subgraph intake["Intake — automated"]
    direction TB
    a1["Validate policy"]
    a2{"Policy active<br/>and in cover?"}
    a3["Auto-assess<br/><i>rules + model</i>"]
    a4{"Confidence<br/>&ge; threshold?"}
  end
  subgraph handler["Claims Handler"]
    direction TB
    h1["Manual review"]
    h2{"Approve?"}
  end
  subgraph fin["Finance"]
    direction TB
    p1["Schedule payment"]
  end

  c1 --> a1 --> a2
  a2 -->|"no"| r1(["Reject — notify with reason"])
  a2 -->|"yes"| a3 --> a4
  a4 -->|"yes"| p1
  a4 -->|"no"| h1 --> h2
  h2 -->|"yes"| p1
  h2 -->|"no"| r2(["Decline — notify with appeal route"])
  p1 --> e1(["Paid"])

flowchart TB
  subgraph fwd["Forward path"]
    direction LR
    f1["1. Reserve stock"] --> f2["2. Authorise payment"] --> f3["3. Create consignment"] --> f4["4. Capture payment"] --> f5["5. Despatch"]
  end
  subgraph comp["Compensation"]
    direction RL
    k1["Release stock"] --- k2["Void authorisation"] --- k3["Cancel consignment"] --- k4["Refund<br/><i>visible to customer</i>"]
  end
  f1 -.->|"undo"| k1
  f2 -.->|"undo"| k2
  f3 -.->|"undo"| k3
  f4 -.->|"undo"| k4
  f5 -.->|"no undo — goods have left"| x(["point of no return"])

flowchart LR
  s1[("core_banking.accounts<br/><i>source</i>")]
  s2[("payments.transactions<br/><i>source</i>")]
  s3[("crm.customer<br/><i>source</i>")]

  j1{{"job: cdc_ingest<br/><i>hourly</i>"}}
  j2{{"job: conform_party<br/><i>daily 02:00</i>"}}
  j3{{"job: build_balances<br/><i>daily 03:15</i>"}}
  j4{{"job: reg_extract<br/><i>monthly</i>"}}

  r1[("raw.accounts")]
  r2[("raw.transactions")]
  c1[("clean.party")]
  c2[("clean.balance_daily")]
  o1[("report.capital_adequacy")]
  o2["Dashboard:<br/>Treasury Daily"]

  s1 --> j1 --> r1
  s2 --> j1 --> r2
  s3 --> j2
  r1 --> j2 --> c1
  r1 --> j3
  r2 --> j3 --> c2
  c1 --> j3
  c2 --> j4 --> o1
  c2 --> o2

flowchart LR
  subgraph t4["Restricted"]
    direction TB
    a1["Card PAN · health records<br/>government ID images"]
    a2["<i>controls:</i> tokenise at edge<br/>field encryption · CMK<br/>no non-prod copies<br/>access JIT + approved<br/>full audit"]
  end
  subgraph t3["Confidential"]
    direction TB
    b1["Personal data · salary<br/>contracts · pricing"]
    b2["<i>controls:</i> encrypt at rest + transit<br/>masked in non-prod<br/>RBAC + quarterly review<br/>DLP on egress"]
  end
  subgraph t2["Internal"]
    direction TB
    c1["Operational metrics<br/>internal docs"]
    c2["<i>controls:</i> authenticated access<br/>standard retention"]
  end
  subgraph t1["Public"]
    direction TB
    d1["Published pricing<br/>marketing content"]
    d2["<i>controls:</i> integrity only"]
  end

  t4 --> s1[("Core DB · EU · Restricted")]
  t3 --> s1
  t3 --> s2[("Warehouse · EU · Confidential")]
  t2 --> s2
  t2 --> s3[("Object store · Internal")]
  t1 --> s3

flowchart TB
  hsm[("HSM / Key Service<br/><i>root of trust · FIPS 140-2 L3</i>")]
  cmk["Customer Master Key<br/><i>per environment · rotate 1y</i>"]
  dek["Data Encryption Keys<br/><i>per dataset · rotate 90d</i>"]

  hsm --> cmk -->|"wraps"| dek

  subgraph vault["Secret Store"]
    direction TB
    v1["Static secrets<br/><i>rotate 90d</i>"]
    v2["Dynamic credentials<br/><i>DB · TTL 1h</i>"]
    v3["PKI issuer<br/><i>mTLS certs · TTL 24h</i>"]
  end
  cmk -->|"encrypts vault at rest"| vault

  subgraph wl["Workloads"]
    direction TB
    w1["Service A<br/><i>workload identity</i>"]
    w2["Pipeline<br/><i>OIDC federation</i>"]
  end

  w1 -->|"attests identity — no stored secret"| vault
  w2 -->|"short-lived token — no stored secret"| vault
  vault -->|"lease · auto-renew · revocable"| w1
  dek -->|"envelope decrypt"| w1
  audit[("Audit log<br/><i>every issue and revoke</i>")]
  vault --> audit

flowchart LR
  user(["Customer<br/><i>untrusted</i>"])
  admin(["Admin<br/><i>privileged</i>"])

  subgraph edge["Boundary 1 — public edge"]
    cdn["CDN / WAF"]
  end

  subgraph app["Boundary 2 — application tier"]
    direction TB
    api["Order API"]
    auth["Auth Service"]
  end

  subgraph datab["Boundary 3 — data tier"]
    direction TB
    db[("Order Store<br/><i>PII + card token</i>")]
    kms[("Key Vault")]
  end

  ext["Payment Provider<br/><i>third party</i>"]

  user -->|"F1 HTTPS"| cdn
  cdn -->|"F2 HTTPS + mTLS"| api
  admin -->|"F3 admin console"| api
  api -->|"F4 token introspection"| auth
  api -->|"F5 TLS + parameterised"| db
  api -->|"F6 fetch DEK"| kms
  api -->|"F7 HTTPS outbound"| ext
  ext -->|"F8 webhook — signed"| cdn