The platform executes workflows; it does not implement them. Task business logic lives in handler plugins owned by domain teams, which is what lets a new task type ship without an orchestrator release.
Downstream systems are drawn as first-class actors rather than an anonymous cloud, because their rate limits and idempotency behaviour are the single largest constraint on the design. The identity SaaS capped at 50 rps shapes view 21 more than any internal component does.
Operations is on the context diagram as a bidirectional actor. An orchestration platform without a human intervention path is an orchestration platform that becomes an incident.
Scale assumed
40 tenants, 2,400 published workflow definitions, 1.8M task executions per day peaking near 900 per second, average workflow 12 tasks with a 500-task ceiling, p99 payload 40 KB.
10,000 concurrently running workflow executions, worker fleet elastic from 1 to 100+ pods, 99.9% API availability, p95 submit under 300 ms and p95 task scheduling under 1 second.
Every figure is a stated exercise assumption. They size Cosmos RU, Service Bus messaging units and the KEDA bounds, so they are the first thing to confirm against real traffic.
Out of scope
Business logic, compensating transactions and saga semantics inside handlers. The platform guarantees the task runs; it does not know what the task means.
A visual workflow designer. Workflows arrive as versioned JSON or YAML through the CLI or CI, which keeps definitions reviewable in a pull request.
Long-running human approval steps measured in days. Those are modelled as an external system that calls back, not as a paused task holding a message lock.
