Backup and Restore Service  ·  View 03 of 26  ·  2 · People and journeys

Actors and Their Core Journeys

Who depends on a restore working, what each of them is actually trying to get done, and the two machines that act without being asked.

Editable source SVG draw.io All views
People who own the data Data owner 40 service teams Goal — Know, with a date, that my datastore comes back inside its RTO. Core journeys Enrol a datastore to PROVEN Restore a table side by side Read my cost and attainment Application team depth-4 owners Goal — Have the restored copy boot my service, not just open. Core journeys Ship a smoke suite Fix a failed rehearsal People who run recovery On-call SRE follow-the-sun Goal — Get back to before the corruption, not merely to last night. Core journeys Recover from old corruption Restore with the console down Run a quarterly gameday Backup platform team 6 engineers Goal — Certify every engine upgrade before it can write a bad copy. Core journeys Certify a tool version Rebuild the catalogue by scan People who guard the copies Custody officer 5, two needed Goal — Make sure nobody, including me, can quietly shorten a retention. Core journeys Co-approve a retention change Place a legal hold Auditor · CISO quarterly Goal — See proof of restore, not a green backup dashboard. Core journeys Sample restore evidence Verify a disposal certificate Machines that act unasked Rehearsal pipeline ≈ 35 runs a day Goal — Restore through the real path and write down what I saw. Core journeys Daily Tier 1 full restore Tier 2 rotation Coverage scanner every 15 min Goal — Find the datastore nobody enrolled before it is needed. Core journeys Raise the 72-hour incident Actors and Their Core Journeys Person or role Journey / task Security / platform v 1.0 · owner Platform Architecture · date 2026-09

Decisions

  • Data owners declare the tier, and the platform refuses a datastore with no tier instead of quietly applying a default. A default tier is an RPO nobody agreed to.
  • Custody officers are a separate group from the backup platform team. The people who run backups must not be the people who can shorten how long backups are kept.
  • The rehearsal pipeline and the coverage scanner are listed as actors with goals. They carry the platform's main promises, and a scheduled job with no owner is the first thing that silently stops.

Assumptions

  • 40 service teams, each with a named owner in NetBox or a namespace label. A datastore with no owner is itself a coverage finding.
  • Five custody officers drawn from security and risk, any two of whom can approve. None of them is on the backup platform team.

What the set must answer

  • For the data owner: a date, not a green tick. View 22 is the answer.
  • For the SRE: a way back to before the corruption. Views 14 and 16.
  • For the auditor: evidence of restore, kept longer than the copies it covers. Views 10 and 11.
◀  High-Level Architecture All views Journey — Data Owner Takes a New Datastore to PROVEN  ▶
Solution Architecture v1.0 · Platform Architecture · 2026-09 · 26 views · open source, fully on-premises03-actors-and-journeys