A platform integrates retailer systems with inconsistent models. What does an anti-corruption layer prevent, and where does it belong?

What it prevents

External models propagating into your domain. Without translation at the boundary, a partner's field names, status codes, units and structural quirks spread through the system — and then a partner's change becomes a change to your core model, and your model becomes the union of every partner's peculiarities.

The consequences compound: every downstream service handles fields applying to one partner, adding partner 301 changes code that partners 1–300 depend on, and the model changes whenever any partner changes — which is the exact opposite of what the boundary exists to provide.

Where it belongs

At the edge of your domain, owned by you, with translation as explicit code.

• One adapter per external system, the only place allowed to know that partner's name.
• A canonical model expressing what your product needs, not the union of what partners offer. This is the decisive design choice.
• Explicit mapping, including units, time zones, currency, status semantics and null handling.
• Validation at the boundary, rejecting or quarantining rather than defaulting silently — because defaulting a missing field turns a partner's data problem into an unattributable platform correctness problem.

What must not be flattened

Genuine differences that are load-bearing. Some partners report inventory continuously and some nightly; some offer structured cancellation terms and some free text; some have throughput ceilings orders of magnitude apart.

Model these as explicit capability flags the product logic consults, rather than as fields in the core model or as silent defaults. Flattening real differences produces silent incorrectness, which is worse than the duplication it removes.

The reliability dimension

Each adapter carries a per-partner reliability profile as configuration — timeout, retry budget, concurrency ceiling, circuit state, freshness tolerance — so tuning a degraded partner is a configuration change and one partner's bad day cannot consume the fan-out's capacity.

The strategic property

The anti-corruption layer is also the seam for replacement. When a partner integration is rebuilt or a legacy system retired, only the adapter changes and the domain sees the same model throughout — which is what turns replacement into an internal change rather than a coordinated migration.