A card payment authorisation service runs active-active across two regions. A network partition splits them. Do you keep accepting authorisations, and what breaks either way?
Show the full answer Hide the answer
What the interviewer is testing
Whether you can apply CAP to a domain where the cost of each choice is concrete, and whether you recognise that "it depends" has to resolve into a decision.
The reasoning
During a partition you get consistency or availability, not both. So the question becomes: what does each failure actually cost the business?
If both regions keep authorising, each is working from its own view of the customer's available credit. The same card can be authorised twice against the same headroom, and you discover the overdraw at reconciliation — after the goods have shipped. That is unrecoverable loss, and it scales with the length of the partition.
If only the quorum side accepts, the minority side declines. A declined authorisation is a recoverable annoyance: the customer retries, or the terminal falls back. The loss is bounded by the partition duration and it is measured in conversion, not in fraud.
For authorisation against a shared balance, CP is the right answer. The asymmetry is that a false approval cannot be undone and a false decline can be retried.
Where the nuance is
The answer changes with the operation, which is the part strong candidates reach:
| Operation | Choice | Why |
|---|---|---|
| Authorisation against available credit | CP | Double-spend is unrecoverable |
| Low-value contactless under a floor limit | AP | Bounded, insurable loss; issuers already do this |
| Recording a completed settlement | AP | Append-only, no shared invariant to violate |
| Fraud scoring | AP, degraded | Stale model beats no decision |
Real card networks are explicitly hybrid: offline "stand-in" processing exists precisely because the network chose AP with a value cap for a defined class of transaction. The cap is the risk control that makes availability affordable.
What a strong answer adds
- Naming the quorum mechanism: with two regions there is no majority, so you need a third witness — an arbiter in a third region — or you have designed a system that cannot make a decision during a partition.
- Committing to a stand-in policy with an explicit value limit and an explicit exposure ceiling, agreed with risk rather than invented by engineering.
- Noting that the declining region must fail fast and say why, so terminals fall back instead of hanging on a timeout.
Common weak answers
Reciting "CAP means pick two" without applying it. Choosing AP because "availability is what customers want", without pricing the double-spend. Assuming a two-region deployment can maintain a quorum on its own.