[ { "id": "01-system-context", "title": "Event-Driven Notification Platform — System Context", "layout": "context", "canvas": { "width": 1560 }, "colWidth": 260, "system": { "label": "Notification Platform", "sub": "events in · notifications out", "icon": "fa5_bell" }, "groups": [ { "side": "left", "title": "Event producers", "nodes": [ { "id": "c-order", "label": "Order Service", "kind": "external", "sub": "OrderCreated · OrderShipped", "rel": "publishes events", "dir": "in", "kind2": "async", "icon": "fa5_shopping_cart" }, { "id": "c-pay", "label": "Payment Service", "kind": "external", "sub": "PaymentFailed", "rel": "publishes events", "dir": "in", "kind2": "async", "icon": "fa5_credit_card" }, { "id": "c-idp", "label": "Identity Service", "kind": "external", "sub": "OTP · security alert", "rel": "P0 events", "dir": "in", "kind2": "async", "icon": "fa5_id_badge" }, { "id": "c-mkt", "label": "Campaign Manager", "kind": "external", "sub": "bulk audiences", "rel": "batch submit", "dir": "in", "kind2": "batch", "icon": "fa5_bullhorn" } ] }, { "side": "top", "title": "People", "nodes": [ { "id": "c-admin", "label": "Tenant Administrator", "kind": "actor", "rel": "rules · templates", "dir": "in" }, { "id": "c-sup", "label": "Support Engineer", "kind": "actor", "rel": "traces a notification", "dir": "in" }, { "id": "c-recip", "label": "Recipient", "kind": "actor", "rel": "receives · opts out" } ] }, { "side": "right", "title": "Delivery providers", "nodes": [ { "id": "c-mail", "label": "Email providers", "kind": "external", "sub": "Postal · Amazon SES", "rel": "SMTP · REST", "icon": "fa5_envelope" }, { "id": "c-sms", "label": "SMS aggregators", "kind": "external", "sub": "Jasmin · Twilio", "rel": "SMPP 3.4", "icon": "fa5_sms" }, { "id": "c-push", "label": "FCM and APNs", "kind": "external", "rel": "HTTP/2 push", "icon": "fa5_mobile_alt" }, { "id": "c-chat", "label": "Slack and Teams", "kind": "external", "rel": "chat webhook", "icon": "fa5_comments" }, { "id": "c-hook", "label": "Partner webhooks", "kind": "external", "rel": "HMAC POST", "icon": "fa5_link" } ] }, { "side": "bottom", "title": "Enterprise services", "nodes": [ { "id": "c-kc", "label": "Keycloak", "kind": "security", "sub": "OIDC · workload identity", "rel": "authenticates producers", "dir": "in", "icon": "keycloak" }, { "id": "c-crm", "label": "Customer Master", "kind": "external", "sub": "system of record", "rel": "contact lookup", "icon": "fa5_address_book" }, { "id": "c-obs", "label": "Grafana LGTM", "kind": "platform", "sub": "metrics · logs · traces", "rel": "telemetry", "icon": "grafana" } ] } ], "note": "Out of scope: producing the business events, owning customer contact data, and anything past the provider accept response.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "02-high-level-architecture", "title": "High-Level Architecture", "layout": "flow", "canvas": { "width": 1780 }, "chain": true, "align": "top", "stages": [ { "title": "Produce", "nodes": [ { "id": "h-app", "label": "Business applications", "kind": "external", "sub": "no PII in payload", "icon": "fa5_building" }, { "id": "h-mkt", "label": "Campaign Manager", "kind": "external", "sub": "bulk audiences", "icon": "fa5_bullhorn" } ] }, { "title": "Ingest", "nodes": [ { "id": "h-gw", "label": "Envoy Gateway", "kind": "integration", "sub": "mTLS · JWT · quota", "icon": "envoy" }, { "id": "h-ing", "label": "Event Ingest API", "kind": "app", "sub": "Go · ack p95 80 ms", "icon": "go" }, { "id": "h-sr", "label": "Schema Registry", "kind": "platform", "sub": "Avro · backward only", "icon": "fa5_book" } ] }, { "title": "Distribute", "nodes": [ { "id": "h-kafka", "label": "Apache Kafka", "kind": "queue", "sub": "3 priority tiers · RF 3", "icon": "kafka" }, { "id": "h-arch", "label": "Event Archive", "kind": "store", "sub": "Iceberg · 400 d", "icon": "fa5_archive" } ] }, { "title": "Decide", "nodes": [ { "id": "h-rules", "label": "Rules Engine", "kind": "app", "sub": "Flink · CEL conditions", "icon": "flink" }, { "id": "h-pref", "label": "Preference Service", "kind": "app", "sub": "consent · quiet hours", "icon": "fa5_sliders_h" }, { "id": "h-orch", "label": "Orchestrator", "kind": "app", "sub": "Temporal workflows", "icon": "temporal" } ] }, { "title": "Compose", "nodes": [ { "id": "h-tpl", "label": "Template Service", "kind": "app", "sub": "versioned · localised", "icon": "fa5_file_alt" }, { "id": "h-rend", "label": "Render Service", "kind": "app", "sub": "Handlebars · MJML", "icon": "di2_handlebars" }, { "id": "h-rl", "label": "Rate Limiter", "kind": "app", "sub": "Redis token bucket", "icon": "redis" } ] }, { "title": "Deliver", "nodes": [ { "id": "h-work", "label": "Channel Workers", "kind": "app", "sub": "6 channels · Go" }, { "id": "h-prov", "label": "Providers", "kind": "external", "sub": "2 per channel", "icon": "fa5_paper_plane" }, { "id": "h-del", "label": "Delivery Store", "kind": "store", "sub": "ClickHouse · 90 d", "icon": "clickhouse" } ] } ], "edges": [ { "from": "h-kafka", "to": "h-arch", "label": "5 min micro-batch", "kind": "batch" }, { "from": "h-prov", "to": "h-del", "label": "receipts", "kind": "async" } ], "note": "Retry, channel fallback, scheduling and every failure path are deliberately omitted here — acts 4 and 6 carry them.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "03-layered-architecture", "title": "Layered Architecture", "layout": "bands", "canvas": { "width": 1700 }, "layerHeaderWidth": 150, "bands": [ { "name": "Experience", "nodes": [ { "id": "l-console", "label": "Admin Console", "kind": "app", "sub": "React", "icon": "react" }, { "id": "l-inbox", "label": "Recipient Inbox", "kind": "app", "sub": "Centrifugo WebSocket", "icon": "fa5_inbox" }, { "id": "l-sdk", "label": "Producer SDKs", "kind": "app", "sub": "Go · Java · Python", "icon": "go" } ] }, { "name": "API", "nodes": [ { "id": "l-evtapi", "label": "Event API", "kind": "integration", "sub": "POST /v1/events", "icon": "openapi" }, { "id": "l-notapi", "label": "Notification API", "kind": "integration", "sub": "direct send", "icon": "go" }, { "id": "l-prefapi", "label": "Preference API", "kind": "integration", "icon": "openapi" }, { "id": "l-tplapi", "label": "Template API", "kind": "integration", "icon": "openapi" }, { "id": "l-admapi", "label": "Admin API", "kind": "integration", "sub": "replay · config", "icon": "openapi" } ] }, { "name": "Decision", "nodes": [ { "id": "l-rules", "label": "Rules Engine", "kind": "app", "sub": "CEL over event + context", "icon": "flink" }, { "id": "l-orch", "label": "Orchestrator", "kind": "app", "sub": "multi-step · fallback", "icon": "temporal" }, { "id": "l-pref", "label": "Preference Service", "kind": "app", "icon": "fa5_sliders_h" }, { "id": "l-sched", "label": "Scheduler", "kind": "app", "sub": "timers · cron · digests", "icon": "temporal" } ] }, { "name": "Composition", "nodes": [ { "id": "l-tpl", "label": "Template Service", "kind": "app", "sub": "draft · published · rollback", "icon": "fa5_file_alt" }, { "id": "l-rend", "label": "Render Service", "kind": "app", "icon": "di2_handlebars" }, { "id": "l-prof", "label": "Recipient Profile", "kind": "app", "sub": "subject_ref to contact", "icon": "fa5_address_book" }, { "id": "l-i18n", "label": "Localisation", "kind": "app", "sub": "locale · timezone", "icon": "fa5_language" } ] }, { "name": "Delivery", "nodes": [ { "id": "l-route", "label": "Channel Router", "kind": "app", "icon": "fa5_random" }, { "id": "l-spi", "label": "Channel Adapter SPI", "kind": "app", "sub": "one contract per channel", "icon": "fa5_plug" }, { "id": "l-workers", "label": "Delivery Workers", "kind": "app", "sub": "6 channel pools", "icon": "fa5_cogs" }, { "id": "l-pc", "label": "Provider Clients", "kind": "integration", "sub": "2 per channel", "icon": "fa5_paper_plane" } ] }, { "name": "Messaging", "nodes": [ { "id": "l-kafka", "label": "Apache Kafka", "kind": "queue", "sub": "Strimzi · KRaft", "icon": "kafka" }, { "id": "l-sr", "label": "Schema Registry", "kind": "platform", "sub": "Apicurio · Avro", "icon": "fa5_book" }, { "id": "l-dlq", "label": "DLQ Topics", "kind": "queue", "sub": "per tier · 30 d", "icon": "kafka" } ] }, { "name": "Data", "nodes": [ { "id": "l-pg", "label": "PostgreSQL", "kind": "store", "sub": "notifications · config", "icon": "postgresql" }, { "id": "l-ch", "label": "ClickHouse", "kind": "store", "sub": "delivery attempts", "icon": "clickhouse" }, { "id": "l-redis", "label": "Redis", "kind": "store", "sub": "dedup · counters", "icon": "redis" }, { "id": "l-minio", "label": "MinIO and Iceberg", "kind": "store", "sub": "archive · audit", "icon": "minio" } ] }, { "name": "Platform", "nodes": [ { "id": "l-k8s", "label": "Kubernetes", "kind": "platform", "icon": "kubernetes" }, { "id": "l-istio", "label": "Istio ambient", "kind": "security", "sub": "mTLS everywhere", "icon": "istio" }, { "id": "l-vault", "label": "HashiCorp Vault", "kind": "security", "sub": "tenant credentials", "icon": "vault" }, { "id": "l-kc", "label": "Keycloak", "kind": "security", "sub": "OIDC", "icon": "keycloak" }, { "id": "l-lgtm", "label": "Grafana LGTM", "kind": "platform", "sub": "observability", "icon": "grafana" } ] } ], "edges": [ { "from": "l-console", "to": "l-admapi", "label": "REST + OIDC" }, { "from": "l-evtapi", "to": "l-kafka", "label": "produce acks=all", "kind": "async" }, { "from": "l-rules", "to": "l-orch", "label": "notification intent", "kind": "async" }, { "from": "l-orch", "to": "l-rend", "label": "render request" }, { "from": "l-rend", "to": "l-workers", "label": "composed message", "kind": "async" }, { "from": "l-workers", "to": "l-pg", "label": "writes" }, { "from": "l-pref", "to": "l-redis", "label": "cached preferences" }, { "from": "l-workers", "to": "l-inbox", "label": "upward call", "kind": "error", "route": "gutter" } ], "note": "Dependencies point downward with one exception, drawn in red: the in-app worker pushes into the experience layer. Accepted because the alternative is client polling at 750 M notifications a day.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "04-container-architecture", "title": "Container and Component Architecture", "layout": "nested", "canvas": { "width": 1820 }, "boxes": [ { "title": "Notification Platform · Kubernetes with Istio ambient mesh", "kind": "cloud", "dir": "col", "children": [ { "title": "Edge and API", "kind": "boundary", "nodes": [ { "id": "n-gw", "label": "Envoy Gateway", "kind": "integration", "sub": "mTLS · JWT · quota", "icon": "envoy" }, { "id": "n-ing", "label": "Event Ingest API", "kind": "app", "sub": "Go · 12 pods", "icon": "go" }, { "id": "n-notapi", "label": "Notification API", "kind": "app", "sub": "Go · 6 pods", "icon": "go" }, { "id": "n-admapi", "label": "Admin API", "kind": "app", "sub": "Go · 3 pods", "icon": "openapi" }, { "id": "n-console", "label": "Admin Console", "kind": "app", "sub": "React · static", "icon": "react" } ] }, { "title": "Decision plane", "kind": "boundary", "nodes": [ { "id": "n-rules", "label": "Rules Engine", "kind": "app", "sub": "Flink · 24 task managers", "icon": "flink" }, { "id": "n-dedup", "label": "Dedup Processor", "kind": "app", "sub": "Flink keyed state · 7 d", "icon": "flink" }, { "id": "n-orch", "label": "Orchestrator", "kind": "app", "sub": "Temporal · 40 workers", "icon": "temporal" }, { "id": "n-pref", "label": "Preference Service", "kind": "app", "sub": "Go · 8 pods", "icon": "fa5_sliders_h" }, { "id": "n-sched", "label": "Scheduler", "kind": "app", "sub": "Temporal cron", "icon": "temporal" } ] }, { "title": "Composition plane", "kind": "boundary", "nodes": [ { "id": "n-tpl", "label": "Template Service", "kind": "app", "sub": "Go · 4 pods", "icon": "fa5_file_alt" }, { "id": "n-rend", "label": "Render Service", "kind": "app", "sub": "Go · 20 pods", "icon": "di2_handlebars" }, { "id": "n-prof", "label": "Recipient Profile", "kind": "app", "sub": "Go · 8 pods", "icon": "fa5_address_book" }, { "id": "n-rl", "label": "Rate Limiter", "kind": "app", "sub": "Redis Lua", "icon": "redis" } ] }, { "title": "Delivery plane", "kind": "boundary", "nodes": [ { "id": "n-wmail", "label": "Email Worker", "kind": "app", "sub": "Go · 30 pods", "icon": "fa5_envelope" }, { "id": "n-wsms", "label": "SMS Worker", "kind": "app", "sub": "Go · 12 pods", "icon": "fa5_sms" }, { "id": "n-wpush", "label": "Push Worker", "kind": "app", "sub": "Go · 16 pods", "icon": "fa5_bell" }, { "id": "n-winapp", "label": "In-App Worker", "kind": "app", "sub": "Go · 8 pods", "icon": "fa5_inbox" }, { "id": "n-whook", "label": "Webhook Worker", "kind": "app", "sub": "Go · 10 pods", "icon": "fa5_link" }, { "id": "n-wchat", "label": "Chat Worker", "kind": "app", "sub": "Go · 4 pods", "icon": "fa5_comments" } ] }, { "title": "Stateful services", "kind": "boundary", "nodes": [ { "id": "n-kafka", "label": "Apache Kafka", "kind": "queue", "sub": "Strimzi · 12 brokers", "icon": "kafka" }, { "id": "n-pg", "label": "PostgreSQL", "kind": "store", "sub": "CloudNativePG · HA", "icon": "postgresql" }, { "id": "n-ch", "label": "ClickHouse", "kind": "store", "sub": "3 shards × 2 replicas", "icon": "clickhouse" }, { "id": "n-redis", "label": "Redis Cluster", "kind": "store", "sub": "6 nodes", "icon": "redis" }, { "id": "n-minio", "label": "MinIO", "kind": "store", "sub": "Iceberg warehouse", "icon": "minio" } ] } ] } ], "outside": [ { "id": "n-kc", "label": "Keycloak", "kind": "security", "sub": "OIDC", "icon": "keycloak" }, { "id": "n-vault", "label": "HashiCorp Vault", "kind": "security", "sub": "tenant credentials", "icon": "vault" }, { "id": "n-lgtm", "label": "Grafana LGTM", "kind": "platform", "sub": "observability", "icon": "grafana" }, { "id": "n-prov", "label": "Channel providers", "kind": "external", "sub": "email · SMS · push · chat", "icon": "fa5_paper_plane" }, { "id": "n-crm", "label": "Customer Master", "kind": "external", "sub": "contact lookup", "icon": "fa5_address_book" } ], "edges": [ { "from": "n-gw", "to": "n-ing", "label": "HTTP/2 · mTLS" }, { "from": "n-ing", "to": "n-kafka", "label": "produce acks=all", "kind": "async" }, { "from": "n-kafka", "to": "n-rules", "label": "consume evt.valid", "kind": "async" }, { "from": "n-rules", "to": "n-orch", "label": "notif.intent", "kind": "async" }, { "from": "n-orch", "to": "n-rend", "label": "gRPC render" }, { "from": "n-rend", "to": "n-prof", "label": "resolve contact" }, { "from": "n-rend", "to": "n-kafka", "label": "deliver topic", "kind": "async" }, { "from": "n-wmail", "to": "n-prov", "label": "SMTP · REST" }, { "from": "n-wmail", "to": "n-vault", "label": "lease credential" }, { "from": "n-prof", "to": "n-crm", "label": "gRPC · cached 24 h" } ], "note": "Pod counts are the steady-state floor at 5 000 events/s. Every plane scales independently; view 20 gives the signals and the ceilings.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "05-integration-architecture", "title": "Integration and Interface Catalogue", "layout": "hub", "canvas": { "width": 1720 }, "left": { "title": "Inbound — who calls us", "nodes": [ { "id": "i-app", "label": "Business applications", "kind": "external", "rel": "POST /v1/events", "icon": "fa5_building" }, { "id": "i-bulk", "label": "Campaign Manager", "kind": "external", "rel": "bulk API · 10 k/batch", "icon": "fa5_bullhorn" }, { "id": "i-native", "label": "Native Kafka producers", "kind": "external", "rel": "SASL/SCRAM · Avro", "icon": "kafka" }, { "id": "i-direct", "label": "Transactional callers", "kind": "external", "rel": "POST /v1/notifications", "icon": "fa5_building" }, { "id": "i-console", "label": "Admin Console", "kind": "app", "rel": "REST + OIDC", "icon": "react" }, { "id": "i-inbox", "label": "Recipient apps", "kind": "external", "rel": "WebSocket inbox", "icon": "fa5_mobile_alt" }, { "id": "i-gitops", "label": "Template GitOps", "kind": "integration", "rel": "signed bundle", "kind2": "batch", "icon": "git" } ] }, "centre": { "title": "Platform", "nodes": [ { "id": "i-core", "label": "Notification Platform", "kind": "app", "sub": "OpenAPI 3.1 · AsyncAPI 3", "icon": "fa5_bell" } ] }, "right": { "title": "Outbound — what we call", "nodes": [ { "id": "o-mail", "label": "Postal and Amazon SES", "kind": "external", "rel": "SMTP · REST", "dir": "out", "icon": "fa5_envelope" }, { "id": "o-sms", "label": "Jasmin and Twilio", "kind": "external", "rel": "SMPP 3.4", "dir": "out", "icon": "fa5_sms" }, { "id": "o-push", "label": "FCM and APNs", "kind": "external", "rel": "HTTP/2", "dir": "out", "icon": "fa5_mobile_alt" }, { "id": "o-chat", "label": "Slack and Teams", "kind": "external", "rel": "chat webhook", "dir": "out", "icon": "fa5_comments" }, { "id": "o-hook", "label": "Partner webhooks", "kind": "external", "rel": "HMAC POST", "dir": "out", "icon": "fa5_link" }, { "id": "o-crm", "label": "Customer Master", "kind": "external", "rel": "gRPC lookup", "dir": "out", "icon": "fa5_address_book" }, { "id": "o-kc", "label": "Keycloak", "kind": "security", "rel": "JWKS", "dir": "out", "icon": "keycloak" }, { "id": "o-vault", "label": "HashiCorp Vault", "kind": "security", "rel": "1 h lease", "dir": "out", "icon": "vault" } ] }, "note": "Every inbound interface is versioned and contract-tested in CI. Every outbound provider has a documented second vendor; none is a platform dependency.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "06-channel-abstraction", "title": "Channel Abstraction — One Contract, Six Adapters", "layout": "swimlane", "canvas": { "width": 1800 }, "laneHeaderWidth": 150, "stages": [ "Resolve address", "Render", "Throttle", "Dispatch", "Confirm" ], "lanes": [ { "title": "Email", "cells": [ [ { "id": "ca-e1", "label": "Verified address", "kind": "app", "sub": "from PII Vault" } ], [ { "id": "ca-e2", "label": "MJML to HTML", "kind": "app", "sub": "plus text alternative", "icon": "di2_handlebars" } ], [ { "id": "ca-e3", "label": "200 msg/s per tenant", "kind": "app" } ], [ { "id": "ca-e4", "label": "Postal MTA", "kind": "external", "sub": "SES on failover", "icon": "fa5_envelope" } ], [ { "id": "ca-e5", "label": "Bounce and open", "kind": "queue", "sub": "provider webhook" } ] ] }, { "title": "SMS", "cells": [ [ { "id": "ca-s1", "label": "E.164 MSISDN", "kind": "app", "sub": "country validated" } ], [ { "id": "ca-s2", "label": "GSM-7 segmenter", "kind": "app", "sub": "160 char parts" } ], [ { "id": "ca-s3", "label": "Carrier TPS cap", "kind": "app", "sub": "per route" } ], [ { "id": "ca-s4", "label": "Jasmin SMSC", "kind": "external", "sub": "SMPP bind", "icon": "fa5_sms" } ], [ { "id": "ca-s5", "label": "DLR receipt", "kind": "queue" } ] ] }, { "title": "Push", "cells": [ [ { "id": "ca-p1", "label": "Device token set", "kind": "app", "sub": "per platform" } ], [ { "id": "ca-p2", "label": "FCM and APNs payload", "kind": "app", "sub": "4 KB limit" } ], [ { "id": "ca-p3", "label": "1 per device per min", "kind": "app" } ], [ { "id": "ca-p4", "label": "FCM HTTP v1", "kind": "external", "sub": "APNs direct", "icon": "fa5_mobile_alt" } ], [ { "id": "ca-p5", "label": "Token invalidation", "kind": "queue", "sub": "prunes dead devices" } ] ] }, { "title": "In-app", "cells": [ [ { "id": "ca-i1", "label": "Inbox identity", "kind": "app", "sub": "no external contact" } ], [ { "id": "ca-i2", "label": "JSON card", "kind": "app", "sub": "action buttons" } ], [ { "id": "ca-i3", "label": "None", "kind": "app", "sub": "pull-limited" } ], [ { "id": "ca-i4", "label": "Centrifugo", "kind": "app", "sub": "WebSocket fan-out", "icon": "fa5_broadcast_tower" } ], [ { "id": "ca-i5", "label": "Read receipt", "kind": "queue" } ] ] }, { "title": "Webhook", "cells": [ [ { "id": "ca-w1", "label": "Endpoint and secret", "kind": "app", "sub": "Vault path" } ], [ { "id": "ca-w2", "label": "JSON envelope", "kind": "app", "sub": "stable schema" } ], [ { "id": "ca-w3", "label": "50 rps per endpoint", "kind": "app" } ], [ { "id": "ca-w4", "label": "HMAC-signed POST", "kind": "external", "sub": "customer endpoint", "icon": "fa5_link" } ], [ { "id": "ca-w5", "label": "2xx or retry", "kind": "queue", "sub": "5 attempts" } ] ] }, { "title": "Chat", "cells": [ [ { "id": "ca-c1", "label": "Channel or user ID", "kind": "app" } ], [ { "id": "ca-c2", "label": "Block Kit blocks", "kind": "app", "sub": "Adaptive Card for Teams", "icon": false } ], [ { "id": "ca-c3", "label": "Workspace tier cap", "kind": "app" } ], [ { "id": "ca-c4", "label": "Slack chat.postMessage", "kind": "external", "sub": "Teams Graph", "icon": "fa5_comments" } ], [ { "id": "ca-c5", "label": "Message timestamp", "kind": "queue", "sub": "edit and thread" } ] ] } ], "note": "Adding a channel means implementing one interface — resolve, render, throttle, dispatch, confirm — plus a provider client. No core service changes.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "07-template-lifecycle", "title": "Template and Content Lifecycle", "layout": "flow", "canvas": { "width": 1780 }, "chain": true, "align": "top", "stages": [ { "title": "Author", "nodes": [ { "id": "t-auth", "label": "Tenant Administrator", "kind": "actor" }, { "id": "t-draft", "label": "Draft version", "kind": "app", "sub": "semver · never sent", "icon": "fa5_file_alt" }, { "id": "t-vars", "label": "Variable contract", "kind": "app", "sub": "declared and typed" } ] }, { "title": "Validate", "nodes": [ { "id": "t-syntax", "label": "Syntax and variables", "kind": "decision", "sub": "no undeclared token" }, { "id": "t-safe", "label": "Output sanitisation", "kind": "decision", "sub": "no raw HTML injection" }, { "id": "t-len", "label": "Channel constraints", "kind": "decision", "sub": "SMS length · push 4 KB" } ] }, { "title": "Preview", "nodes": [ { "id": "t-prev", "label": "Render preview", "kind": "app", "sub": "synthetic data" }, { "id": "t-test", "label": "Test send", "kind": "app", "sub": "allow-listed recipients" }, { "id": "t-i18n", "label": "Locale matrix", "kind": "app", "sub": "fallback to en-GB", "icon": "fa5_language" } ] }, { "title": "Approve", "nodes": [ { "id": "t-rev", "label": "Second approver", "kind": "decision", "sub": "required for marketing" }, { "id": "t-legal", "label": "Consent copy check", "kind": "decision", "sub": "unsubscribe present" } ] }, { "title": "Publish", "nodes": [ { "id": "t-pub", "label": "Published version", "kind": "app", "sub": "immutable · addressable", "icon": "fa5_file_alt" }, { "id": "t-store", "label": "Template Store", "kind": "store", "sub": "all versions kept", "icon": "postgresql" }, { "id": "t-cache", "label": "Render cache warm", "kind": "app", "sub": "60 s propagation" } ] }, { "title": "Operate", "nodes": [ { "id": "t-bind", "label": "Notification binds version", "kind": "app", "sub": "pinned at decision time" }, { "id": "t-roll", "label": "Rollback", "kind": "app", "sub": "repoint alias · no redeploy" }, { "id": "t-audit", "label": "Audit record", "kind": "security", "sub": "who · what · when" } ] } ], "edges": [ { "from": "t-syntax", "to": "t-draft", "label": "rejected", "kind": "error", "route": "gutter" }, { "from": "t-rev", "to": "t-prev", "label": "changes requested", "kind": "error", "route": "gutter" }, { "from": "t-roll", "to": "t-pub", "label": "previous version", "kind": "async" } ], "note": "A notification records the exact template version it rendered, so a rollback never rewrites what was already sent and a support query can reproduce the original message.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "08-multi-tenant-isolation", "title": "Multi-Tenancy — What Is Shared and What Is Not", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Shared compute — one platform, many tenants", "kind": "boundary", "dir": "row", "children": [ { "title": "Shared", "kind": "plain", "nodes": [ { "id": "m-kafka", "label": "Kafka cluster", "kind": "queue", "sub": "tiered topics", "icon": "kafka" }, { "id": "m-k8s", "label": "Kubernetes node pools", "kind": "platform", "icon": "kubernetes" }, { "id": "m-flink", "label": "Flink job", "kind": "app", "sub": "keyed by tenant_id", "icon": "flink" }, { "id": "m-work", "label": "Channel worker pools", "kind": "app", "sub": "shared tier", "icon": "fa5_cogs" } ] }, { "title": "Per tenant", "kind": "plain", "nodes": [ { "id": "m-rules", "label": "Rule set", "kind": "app", "sub": "tenant-scoped CEL", "icon": "fa5_project_diagram" }, { "id": "m-tpl", "label": "Template set", "kind": "app", "icon": "fa5_file_alt" }, { "id": "m-cred", "label": "Provider credentials", "kind": "security", "sub": "Vault path per tenant", "icon": "vault" }, { "id": "m-quota", "label": "Quota", "kind": "app", "sub": "events/s and notif/day" } ] } ] }, { "title": "Data isolation", "kind": "trust", "dir": "row", "children": [ { "title": "Logical — every tenant", "kind": "plain", "nodes": [ { "id": "m-pg", "label": "Notification Store", "kind": "store", "sub": "RLS on tenant_id", "icon": "postgresql" }, { "id": "m-pref", "label": "Preference Store", "kind": "store", "sub": "RLS on tenant_id", "icon": "postgresql" }, { "id": "m-ch", "label": "Delivery Store", "kind": "store", "sub": "tenant_id sort key", "icon": "clickhouse" }, { "id": "m-dek", "label": "PII Vault", "kind": "store", "sub": "per-tenant data key", "icon": "fa5_user_lock" } ] }, { "title": "Physical — dedicated tier", "kind": "plain", "nodes": [ { "id": "m-dtopic", "label": "Dedicated topics", "kind": "queue", "sub": "top 5 tenants" }, { "id": "m-dpool", "label": "Dedicated worker pool", "kind": "app", "sub": "taint and toleration" }, { "id": "m-dpg", "label": "Dedicated database", "kind": "store", "sub": "regulated tenants" } ] } ] }, { "title": "Noisy-neighbour controls", "kind": "boundary", "dir": "row", "children": [ { "title": "Admission", "kind": "plain", "nodes": [ { "id": "m-rps", "label": "Gateway quota", "kind": "integration", "sub": "per-tenant rps + burst", "icon": "envoy" }, { "id": "m-tier", "label": "Priority tiering", "kind": "queue", "sub": "P0 · P1 · P2" }, { "id": "m-size", "label": "Payload cap", "kind": "decision", "sub": "64 KB hard" } ] }, { "title": "Execution", "kind": "plain", "nodes": [ { "id": "m-conc", "label": "Consumer concurrency cap", "kind": "app", "sub": "per tenant per channel" }, { "id": "m-tps", "label": "Provider TPS budget", "kind": "app", "sub": "fair share" }, { "id": "m-cb", "label": "Circuit breaker", "kind": "security", "sub": "tenant × provider", "icon": "fa5_bolt" } ] } ] } ], "outside": [ { "id": "m-risk", "label": "Shared Flink job", "kind": "risk", "sub": "one hot key lags a partition" }, { "id": "m-metrics", "label": "Per-tenant metrics", "kind": "platform", "sub": "lag · spend · error rate", "icon": "grafana" } ], "edges": [ { "from": "m-rps", "to": "m-tier", "label": "classified" }, { "from": "m-tier", "to": "m-kafka", "label": "tier topic", "kind": "async" }, { "from": "m-flink", "to": "m-risk", "label": "skew risk", "kind": "error" }, { "from": "m-cb", "to": "m-metrics", "label": "trip events", "kind": "async" } ], "note": "Tenants share compute by default and buy isolation where they need it. The one unsolved risk is drawn in red: a single hot tenant key can lag a Flink partition, mitigated by key salting on the P2 tier only.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "09-data-flow", "title": "Data Flow — Event, Notification, Delivery", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "top", "stages": [ { "title": "Origin", "nodes": [ { "id": "d-prod", "label": "Producer application", "kind": "external", "sub": "owns the business fact", "icon": "fa5_building" }, { "id": "d-env", "label": "Event envelope", "kind": "app", "sub": "subject_ref, not PII" } ] }, { "title": "Ingest", "nodes": [ { "id": "d-val", "label": "Validate and stamp", "kind": "app", "sub": "event_id · received_at" }, { "id": "d-schema", "label": "Schema check", "kind": "decision", "sub": "Avro backward" }, { "id": "d-bad", "label": "Invalid events", "kind": "queue", "sub": "evt.invalid · 30 d" } ] }, { "title": "Backbone", "nodes": [ { "id": "d-topic", "label": "Event topics", "kind": "queue", "sub": "key tenant:entity · 7 d", "icon": "kafka" }, { "id": "d-arch", "label": "Event Archive", "kind": "store", "sub": "Iceberg · 400 d", "icon": "fa5_archive" } ] }, { "title": "Decide", "nodes": [ { "id": "d-rules", "label": "Rule evaluation", "kind": "app", "sub": "event plus context", "icon": "flink" }, { "id": "d-intent", "label": "Notification intent", "kind": "queue", "sub": "notif.intent", "icon": "kafka" }, { "id": "d-nstore", "label": "Notification Store", "kind": "store", "sub": "Postgres · 30 d hot", "icon": "postgresql" } ] }, { "title": "Resolve identity", "nodes": [ { "id": "d-prof", "label": "Recipient Profile", "kind": "app", "sub": "subject_ref to contact", "icon": "fa5_address_book" }, { "id": "d-vault", "label": "PII Vault", "kind": "store", "sub": "encrypted · erasable", "icon": "fa5_user_lock" }, { "id": "d-msg", "label": "Rendered message", "kind": "app", "sub": "memory only · never logged" } ] }, { "title": "Deliver and record", "nodes": [ { "id": "d-work", "label": "Channel workers", "kind": "app", "icon": "fa5_cogs" }, { "id": "d-dstore", "label": "Delivery Store", "kind": "store", "sub": "ClickHouse · 90 d", "icon": "clickhouse" }, { "id": "d-audit", "label": "Audit Log", "kind": "security", "sub": "MinIO WORM · 7 y", "icon": "fa5_clipboard_list" } ] } ], "edges": [ { "from": "d-schema", "to": "d-bad", "label": "malformed · pipeline unblocked", "kind": "error" }, { "from": "d-topic", "to": "d-arch", "label": "5 min micro-batch", "kind": "batch" }, { "from": "d-rules", "to": "d-nstore", "label": "on decision", "kind": "sync" }, { "from": "d-prof", "to": "d-vault", "label": "gRPC · scoped read" }, { "from": "d-work", "to": "d-dstore", "label": "per attempt", "kind": "async" }, { "from": "d-work", "to": "d-audit", "label": "audit", "kind": "async" } ], "note": "PII enters at stage five and never reaches the bus, the archive or a log line. An erasure request purges the vault; the event and notification records survive with an unresolvable reference.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "10-event-topology", "title": "Event Topology — Priority Tiers, DLQ and Replay", "layout": "swimlane", "canvas": { "width": 1800 }, "laneHeaderWidth": 170, "stages": [ "Event topic", "Rule evaluation", "Intent topic", "Channel topic", "Failure path" ], "lanes": [ { "title": "P0 · transactional", "cells": [ [ { "id": "q-a1", "label": "evt.valid.p0", "kind": "queue", "sub": "48 part · 7 d" } ], [ { "id": "q-a2", "label": "Reserved slot group", "kind": "app", "sub": "never starved" } ], [ { "id": "q-a3", "label": "notif.intent.p0", "kind": "queue", "sub": "24 partitions" } ], [ { "id": "q-a4", "label": "deliver.*.p0", "kind": "queue", "sub": "consumed first" } ], [ { "id": "q-a5", "label": "dlq.p0", "kind": "queue", "sub": "page on first message" } ] ] }, { "title": "P1 · operational", "cells": [ [ { "id": "q-b1", "label": "evt.valid.p1", "kind": "queue", "sub": "120 part · 7 d" } ], [ { "id": "q-b2", "label": "Default slot group", "kind": "app" } ], [ { "id": "q-b3", "label": "notif.intent.p1", "kind": "queue", "sub": "60 partitions" } ], [ { "id": "q-b4", "label": "deliver.*.p1", "kind": "queue" } ], [ { "id": "q-b5", "label": "dlq.p1", "kind": "queue", "sub": "alert above 100" } ] ] }, { "title": "P2 · bulk and marketing", "cells": [ [ { "id": "q-c1", "label": "evt.valid.p2", "kind": "queue", "sub": "72 part · 3 d" } ], [ { "id": "q-c2", "label": "Capped parallelism", "kind": "app", "sub": "sheds first" } ], [ { "id": "q-c3", "label": "notif.intent.p2", "kind": "queue", "sub": "36 partitions" } ], [ { "id": "q-c4", "label": "deliver.*.p2", "kind": "queue", "sub": "throttled to spare capacity" } ], [ { "id": "q-c5", "label": "dlq.p2", "kind": "queue", "sub": "daily digest" } ] ] }, { "title": "Replay and recovery", "cells": [ [ { "id": "q-d1", "label": "Event Archive", "kind": "store", "sub": "Iceberg · queryable", "icon": "fa5_archive" } ], [ { "id": "q-d2", "label": "Replay Service", "kind": "app", "sub": "range plus filter", "icon": "fa5_history" } ], [ { "id": "q-d3", "label": "evt.replay", "kind": "queue", "sub": "separate consumer group" } ], [ { "id": "q-d4", "label": "Dedup suppresses", "kind": "decision", "sub": "dedup_key match" } ], [ { "id": "q-d5", "label": "Replay audit", "kind": "security", "sub": "who · range · count" } ] ] } ], "note": "Partition key is tenant_id:entity_id, so OrderCreated to OrderDelivered stay ordered for one order without any global ordering guarantee. Tier separation is what stops a marketing burst delaying a one-time passcode.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "11-data-architecture", "title": "Data Architecture and Storage Zones", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Authoritative — cannot be rebuilt, must be backed up", "kind": "trust", "dir": "row", "children": [ { "title": "Configuration", "kind": "plain", "nodes": [ { "id": "z-cfg", "label": "Config Store", "kind": "store", "sub": "rules · tenants · providers", "icon": "postgresql" }, { "id": "z-tplv", "label": "Template versions", "kind": "store", "sub": "every version kept", "icon": "fa5_file_alt" } ] }, { "title": "Consent and identity", "kind": "plain", "nodes": [ { "id": "z-pref", "label": "Preference Store", "kind": "store", "sub": "Postgres · RLS", "icon": "postgresql" }, { "id": "z-pii", "label": "PII Vault", "kind": "store", "sub": "pgcrypto · per-tenant DEK", "icon": "fa5_user_lock" }, { "id": "z-aud", "label": "Audit Log", "kind": "security", "sub": "MinIO object lock · 7 y", "icon": "fa5_clipboard_list" } ] } ] }, { "title": "Operational — rebuildable from the event log", "kind": "boundary", "dir": "row", "children": [ { "title": "Hot", "kind": "plain", "nodes": [ { "id": "z-not", "label": "Notification Store", "kind": "store", "sub": "partitioned · 30 d", "icon": "postgresql" }, { "id": "z-redis", "label": "Redis", "kind": "store", "sub": "dedup 7 d · counters", "icon": "redis" }, { "id": "z-kafka", "label": "Kafka topics", "kind": "queue", "sub": "3 to 7 d retention", "icon": "kafka" } ] }, { "title": "Analytical", "kind": "plain", "nodes": [ { "id": "z-del", "label": "Delivery Store", "kind": "store", "sub": "ClickHouse · 90 d raw", "icon": "clickhouse" }, { "id": "z-agg", "label": "Rolled-up aggregates", "kind": "store", "sub": "13 months", "icon": "clickhouse" } ] } ] }, { "title": "Archive — immutable, cheap, queryable", "kind": "boundary", "dir": "row", "children": [ { "title": "Long term", "kind": "plain", "nodes": [ { "id": "z-evtarc", "label": "Event Archive", "kind": "store", "sub": "Iceberg · 400 d", "icon": "fa5_archive" }, { "id": "z-notarc", "label": "Notification archive", "kind": "store", "sub": "Iceberg · 13 months", "icon": "fa5_archive" } ] } ] } ], "outside": [ { "id": "z-bk", "label": "Backup target", "kind": "store", "sub": "cross-region · PITR 7 d", "icon": "minio" }, { "id": "z-erase", "label": "Erasure job", "kind": "app", "sub": "purge cascade within 30 d", "icon": "fa5_user_slash" }, { "id": "z-trino", "label": "Trino", "kind": "app", "sub": "archive queries · read only", "icon": "trino" } ], "edges": [ { "from": "z-kafka", "to": "z-evtarc", "label": "5 min micro-batch", "kind": "batch" }, { "from": "z-not", "to": "z-notarc", "label": "nightly at 30 d", "kind": "batch" }, { "from": "z-del", "to": "z-agg", "label": "hourly", "kind": "batch" }, { "from": "z-erase", "to": "z-pii", "label": "hard delete", "kind": "error" }, { "from": "z-cfg", "to": "z-bk", "label": "continuous WAL", "kind": "async" }, { "from": "z-trino", "to": "z-evtarc", "label": "SQL read" } ], "note": "The retention numbers are the design. Anything in the operational zone can be lost and reconstructed from the archive; nothing in the authoritative zone can, which is what backup and DR are sized around.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "12-data-model", "title": "Core Data Model", "layout": "er", "canvas": { "width": 1760, "cols": 4 }, "rowGap": 260, "entities": [ { "id": "e-ten", "name": "tenant", "kind": "store", "row": 0, "col": 0, "attrs": [ "tenant_id PK", "name", "tier", "quota_events_sec", "home_region" ] }, { "id": "e-evt", "name": "event", "kind": "store", "row": 0, "col": 1, "attrs": [ "event_id PK", "tenant_id FK", "event_type", "source_app", "subject_ref", "correlation_id", "priority", "idempotency_key UQ", "occurred_at" ] }, { "id": "e-rule", "name": "notification_rule", "kind": "store", "row": 0, "col": 2, "attrs": [ "rule_id PK", "tenant_id FK", "event_type", "condition_cel", "channels", "enabled", "version" ] }, { "id": "e-tpl", "name": "template", "kind": "store", "row": 0, "col": 3, "attrs": [ "template_id PK", "tenant_id FK", "code", "channel", "state" ] }, { "id": "e-rec", "name": "recipient", "kind": "store", "row": 1, "col": 0, "attrs": [ "recipient_id PK", "tenant_id FK", "subject_ref UQ", "locale", "timezone", "consent_state" ] }, { "id": "e-not", "name": "notification", "kind": "store", "row": 1, "col": 1, "attrs": [ "notification_id PK", "event_id FK", "rule_id FK", "recipient_id FK", "channel", "state", "dedup_key UQ", "template_version_id FK", "scheduled_for" ] }, { "id": "e-sch", "name": "schedule", "kind": "store", "row": 1, "col": 2, "attrs": [ "schedule_id PK", "notification_id FK", "fire_at", "cron_expr", "digest_window" ] }, { "id": "e-tplv", "name": "template_version", "kind": "store", "row": 1, "col": 3, "attrs": [ "version_id PK", "template_id FK", "semver", "locale", "body_ref", "published_at" ] }, { "id": "e-pref", "name": "user_preference", "kind": "store", "row": 2, "col": 0, "attrs": [ "preference_id PK", "recipient_id FK", "category", "channel", "enabled", "quiet_start", "quiet_end", "frequency_cap" ] }, { "id": "e-att", "name": "delivery_attempt", "kind": "store", "row": 2, "col": 1, "attrs": [ "attempt_id PK", "notification_id FK", "provider_id FK", "attempt_no", "status", "provider_ref", "error_class", "latency_ms", "attempted_at" ] }, { "id": "e-prov", "name": "channel_provider", "kind": "store", "row": 2, "col": 2, "attrs": [ "provider_id PK", "tenant_id FK", "channel", "vendor", "rank", "credential_path", "tps_limit" ] }, { "id": "e-aud", "name": "audit_record", "kind": "store", "row": 2, "col": 3, "attrs": [ "audit_id PK", "tenant_id FK", "actor", "action", "target_ref", "before_after", "occurred_at" ] } ], "relations": [ { "from": "e-ten", "to": "e-evt", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "e-ten", "to": "e-rec", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "e-evt", "to": "e-not", "label": "1 : N", "from_side": "s", "to_side": "n1" }, { "from": "e-rule", "to": "e-not", "label": "1 : N", "from_side": "s", "to_side": "n3" }, { "from": "e-rec", "to": "e-not", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "e-rec", "to": "e-pref", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "e-not", "to": "e-att", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "e-not", "to": "e-sch", "label": "1 : 0..1", "from_side": "e", "to_side": "w", "kind": "optional" }, { "from": "e-rule", "to": "e-tpl", "label": "1 : 1", "from_side": "e", "to_side": "w" }, { "from": "e-tpl", "to": "e-tplv", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "e-prov", "to": "e-att", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "e-tplv", "to": "e-aud", "label": "1 : N", "from_side": "s", "to_side": "n", "kind": "optional" } ], "note": "Three domains, deliberately separate: event is what happened, notification is what the platform decided, delivery_attempt is what happened while trying. Every table carries tenant_id and is protected by row-level security; those relationships are omitted for readability.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "13-preference-and-consent", "title": "Preference, Consent and Override Policy", "layout": "grid", "canvas": { "width": 1800 }, "laneHeaderWidth": 175, "columns": [ "Consent basis", "Preference respected", "Quiet hours", "Frequency cap", "Override rule" ], "rows": [ { "title": "Security · P0", "cells": [ [ { "id": "pf-a1", "label": "Legitimate interest", "kind": "security", "sub": "no opt-in needed" } ], [ { "id": "pf-a2", "label": "Channel order only", "kind": "app", "sub": "cannot disable" } ], [ { "id": "pf-a3", "label": "Ignored", "kind": "security", "sub": "sent immediately" } ], [ { "id": "pf-a4", "label": "None", "kind": "security" } ], [ { "id": "pf-a5", "label": "Always overrides", "kind": "decision", "sub": "logged as override" } ] ] }, { "title": "Transactional · P0", "cells": [ [ { "id": "pf-b1", "label": "Contract", "kind": "security", "sub": "service delivery" } ], [ { "id": "pf-b2", "label": "Channel choice", "kind": "app", "sub": "at least one mandatory" } ], [ { "id": "pf-b3", "label": "Ignored", "kind": "security" } ], [ { "id": "pf-b4", "label": "None", "kind": "security" } ], [ { "id": "pf-b5", "label": "Overrides opt-out", "kind": "decision", "sub": "reason recorded" } ] ] }, { "title": "Operational · P1", "cells": [ [ { "id": "pf-c1", "label": "Legitimate interest", "kind": "app" } ], [ { "id": "pf-c2", "label": "Fully respected", "kind": "app", "sub": "per category" } ], [ { "id": "pf-c3", "label": "Deferred", "kind": "app", "sub": "recipient timezone" } ], [ { "id": "pf-c4", "label": "10 per day", "kind": "app", "sub": "then digested" } ], [ { "id": "pf-c5", "label": "No override", "kind": "decision" } ] ] }, { "title": "Marketing · P2", "cells": [ [ { "id": "pf-d1", "label": "Explicit opt-in", "kind": "security", "sub": "timestamp and source" } ], [ { "id": "pf-d2", "label": "Fully respected", "kind": "app" } ], [ { "id": "pf-d3", "label": "Deferred", "kind": "app", "sub": "plus local send window" } ], [ { "id": "pf-d4", "label": "3 per week", "kind": "app", "sub": "hard cap" } ], [ { "id": "pf-d5", "label": "Never overrides", "kind": "risk", "sub": "regulatory breach" } ] ] }, { "title": "Digest · P2", "cells": [ [ { "id": "pf-e1", "label": "Inherits source class", "kind": "app" } ], [ { "id": "pf-e2", "label": "Digest opt-in", "kind": "app", "sub": "replaces per-event" } ], [ { "id": "pf-e3", "label": "Scheduled", "kind": "app", "sub": "recipient chosen hour" } ], [ { "id": "pf-e4", "label": "1 per window", "kind": "app" } ], [ { "id": "pf-e5", "label": "P0 items break out", "kind": "decision", "sub": "sent separately" } ] ] } ], "note": "The override column is the whole point of this view. Anything that overrides a stated preference writes an audit record naming the rule that authorised it, so a regulator can be answered from one query.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "14-notification-orchestration", "title": "Notification Orchestration — From Event to Dispatch Decision", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "top", "stages": [ { "title": "Should we notify?", "nodes": [ { "id": "o-evt", "label": "Validated event", "kind": "queue", "sub": "evt.valid.p1", "icon": "kafka" }, { "id": "o-match", "label": "Rule match", "kind": "decision", "sub": "CEL over event plus context", "icon": "fa5_project_diagram" }, { "id": "o-mute", "label": "Suppression list", "kind": "decision", "sub": "incident mute · tenant pause" } ] }, { "title": "Who?", "nodes": [ { "id": "o-res", "label": "Recipient resolution", "kind": "app", "sub": "subject_ref to recipients", "icon": "fa5_address_book" }, { "id": "o-fan", "label": "Fan-out", "kind": "app", "sub": "1 event to N notifications" } ] }, { "title": "What and where?", "nodes": [ { "id": "o-pref", "label": "Preference check", "kind": "decision", "sub": "category · consent", "icon": "fa5_sliders_h" }, { "id": "o-chan", "label": "Channel selection", "kind": "app", "sub": "ordered · fallback chain", "icon": "fa5_random" }, { "id": "o-bind", "label": "Template bind", "kind": "app", "sub": "code · locale · version pinned" } ] }, { "title": "When?", "nodes": [ { "id": "o-time", "label": "Timing router", "kind": "decision", "sub": "now · delay · cron · digest" }, { "id": "o-quiet", "label": "Quiet-hours defer", "kind": "app", "sub": "recipient timezone" } ] }, { "title": "Guardrails", "nodes": [ { "id": "o-dedup", "label": "Deduplication", "kind": "decision", "sub": "dedup_key · 24 h window" }, { "id": "o-cap", "label": "Frequency cap", "kind": "decision", "sub": "per category per window" }, { "id": "o-rl", "label": "Rate limit", "kind": "app", "sub": "tenant · user · provider" }, { "id": "o-drop", "label": "Suppressed", "kind": "risk", "sub": "no rule · opted out · capped" } ] }, { "title": "Dispatch", "nodes": [ { "id": "o-rec", "label": "Notification record", "kind": "store", "sub": "CREATED to QUEUED", "icon": "postgresql" }, { "id": "o-topic", "label": "Channel topic", "kind": "queue", "sub": "deliver.channel.tier", "icon": "kafka" } ] } ], "edges": [ { "from": "o-dedup", "to": "o-drop", "label": "duplicate", "kind": "error" }, { "from": "o-cap", "to": "o-drop", "label": "over cap", "kind": "error" }, { "from": "o-quiet", "to": "o-time", "label": "next allowed window", "kind": "async" } ], "note": "Every suppression increments a labelled counter and writes a reason on the notification record. A notification that was never sent is still a notification with an answer, which is what makes the support question answerable.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "15-event-to-delivery-sequence", "title": "OrderCreated to Delivered Email — Critical Flow", "layout": "sequence", "canvas": { "width": 1780 }, "lifelines": [ { "id": "s-prod", "label": "Order Service", "kind": "external", "icon": "fa5_shopping_cart" }, { "id": "s-ing", "label": "Event Ingest API", "kind": "integration", "icon": "go" }, { "id": "s-kafka", "label": "Kafka", "kind": "queue", "icon": "kafka" }, { "id": "s-rules", "label": "Rules Engine", "kind": "app", "icon": "flink" }, { "id": "s-orch", "label": "Orchestrator", "kind": "app", "icon": "temporal" }, { "id": "s-rend", "label": "Render Service", "kind": "app", "icon": "di2_handlebars" }, { "id": "s-work", "label": "Email Worker", "kind": "app", "icon": "fa5_envelope" }, { "id": "s-mta", "label": "Postal MTA", "kind": "external", "icon": "fa5_envelope" } ], "messages": [ { "from": "s-prod", "to": "s-ing", "label": "POST /v1/events OrderCreated", "kind": "call" }, { "from": "s-ing", "to": "s-ing", "label": "schema · idempotency_key · event_id", "kind": "self" }, { "from": "s-ing", "to": "s-kafka", "label": "produce acks=all", "kind": "async" }, { "from": "s-ing", "to": "s-prod", "label": "202 event_id · p95 80 ms", "kind": "return" }, { "from": "s-kafka", "to": "s-rules", "label": "consume evt.valid.p1", "kind": "async" }, { "from": "s-rules", "to": "s-rules", "label": "CEL match · fan-out to 3 channels", "kind": "self" }, { "from": "s-rules", "to": "s-orch", "label": "notif.intent", "kind": "async" }, { "from": "s-orch", "to": "s-orch", "label": "preferences · quiet hours · dedup", "kind": "self" }, { "from": "s-orch", "to": "s-rend", "label": "render(template v2.4, en-GB)", "kind": "call" }, { "from": "s-rend", "to": "s-rend", "label": "resolve subject_ref to address", "kind": "self" }, { "from": "s-rend", "to": "s-orch", "label": "subject · html · text", "kind": "return" }, { "from": "s-orch", "to": "s-kafka", "label": "deliver.email.p1", "kind": "async" }, { "from": "s-kafka", "to": "s-work", "label": "consume · claim token", "kind": "async" }, { "from": "s-work", "to": "s-mta", "label": "SMTP submit", "kind": "call" }, { "from": "s-mta", "to": "s-work", "label": "250 queued · message-id", "kind": "return" }, { "from": "s-work", "to": "s-kafka", "label": "receipt SENT", "kind": "async" }, { "from": "s-mta", "to": "s-work", "label": "webhook DELIVERED", "kind": "async" } ], "note": "Happy path only. Retry, provider failover and dead-lettering are on view 17. Contact details are resolved inside the Render Service and never travel on the bus.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "16-scheduling-and-digests", "title": "Timing — Immediate, Delayed, Scheduled and Digested", "layout": "swimlane", "canvas": { "width": 1800 }, "laneHeaderWidth": 175, "stages": [ "Timing decision", "Durable wait", "Aggregate", "Becomes due", "Dispatch" ], "lanes": [ { "title": "Immediate · 85%", "cells": [ [ { "id": "k-a1", "label": "Send now", "kind": "decision", "sub": "no preference to defer" } ], [ { "id": "k-a2", "label": "None", "kind": "app", "sub": "straight through", "icon": false } ], [], [ { "id": "k-a4", "label": "notif.due", "kind": "queue", "sub": "p95 under 400 ms", "icon": "kafka" } ], [ { "id": "k-a5", "label": "Channel topic", "kind": "queue", "icon": "kafka" } ] ] }, { "title": "Delayed", "cells": [ [ { "id": "k-b1", "label": "Delay t", "kind": "decision", "sub": "rule sets the offset" } ], [ { "id": "k-b2", "label": "Temporal timer", "kind": "app", "sub": "survives restart", "icon": "temporal" } ], [], [ { "id": "k-b4", "label": "notif.due", "kind": "queue", "sub": "timer fires", "icon": "kafka" } ], [ { "id": "k-b5", "label": "Channel topic", "kind": "queue", "icon": "kafka" } ] ] }, { "title": "Scheduled", "cells": [ [ { "id": "k-c1", "label": "At schedule", "kind": "decision", "sub": "cron per tenant" } ], [ { "id": "k-c2", "label": "Temporal cron", "kind": "app", "sub": "tenant timezone" } ], [], [ { "id": "k-c4", "label": "notif.due", "kind": "queue", "sub": "timer fires", "icon": "kafka" } ], [ { "id": "k-c5", "label": "Channel topic", "kind": "queue", "icon": "kafka" } ] ] }, { "title": "Quiet hours", "cells": [ [ { "id": "k-d1", "label": "In quiet window", "kind": "decision", "sub": "recipient timezone" } ], [ { "id": "k-d2", "label": "Defer to next hour", "kind": "app" } ], [ { "id": "k-d3", "label": "Jittered release", "kind": "app", "sub": "spread over 15 min" } ], [ { "id": "k-d4", "label": "notif.due", "kind": "queue", "sub": "window opens", "icon": "kafka" } ], [ { "id": "k-d5", "label": "Channel topic", "kind": "queue", "icon": "kafka" } ] ] }, { "title": "Digest", "cells": [ [ { "id": "k-e1", "label": "Digest opted in", "kind": "decision", "sub": "replaces per-event" } ], [ { "id": "k-e2", "label": "Session window", "kind": "app", "sub": "Flink · 1 h default", "icon": "flink" } ], [ { "id": "k-e3", "label": "Aggregate buffer", "kind": "store", "sub": "Redis roll-up", "icon": "redis" }, { "id": "k-e3b", "label": "Digest render", "kind": "app", "sub": "N items to 1", "icon": "di2_handlebars" } ], [ { "id": "k-e4", "label": "notif.due", "kind": "queue", "sub": "one message", "icon": "kafka" } ], [ { "id": "k-e5", "label": "Channel topic", "kind": "queue", "icon": "kafka" } ] ] }, { "title": "Breakout", "cells": [ [ { "id": "k-f1", "label": "P0 inside a window", "kind": "decision", "sub": "security or transactional" } ], [ { "id": "k-f2", "label": "None", "kind": "app", "sub": "window bypassed", "icon": false } ], [ { "id": "k-f3", "label": "Left in the digest", "kind": "risk", "sub": "would delay a passcode" } ], [ { "id": "k-f4", "label": "notif.due", "kind": "queue", "sub": "immediately", "icon": "kafka" } ], [ { "id": "k-f5", "label": "Channel topic", "kind": "queue", "icon": "kafka" } ] ] } ], "note": "Every lane converges on the same notif.due stream, so the dispatcher has one code path. Timing state is durable in Temporal and Kafka, never an in-process timer — a pod restart during a two-day delay loses nothing.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "17-retry-and-failover", "title": "Delivery Failure — Retry, Failover and Dead-Lettering", "layout": "sequence", "canvas": { "width": 1720 }, "lifelines": [ { "id": "r-work", "label": "Email Worker", "kind": "app", "icon": "fa5_envelope" }, { "id": "r-rl", "label": "Rate Limiter", "kind": "app", "icon": "redis" }, { "id": "r-p1", "label": "Postal MTA", "kind": "external", "icon": "fa5_envelope" }, { "id": "r-p2", "label": "Amazon SES", "kind": "external", "icon": "fa5_envelope" }, { "id": "r-store", "label": "Delivery Store", "kind": "store", "icon": "clickhouse" }, { "id": "r-dlq", "label": "Kafka DLQ", "kind": "queue", "icon": "kafka" }, { "id": "r-alert", "label": "Alertmanager", "kind": "security", "icon": "prometheus" } ], "messages": [ { "from": "r-work", "to": "r-rl", "label": "acquire token", "kind": "call" }, { "from": "r-rl", "to": "r-work", "label": "granted", "kind": "return" }, { "from": "r-work", "to": "r-p1", "label": "submit · attempt 1", "kind": "call" }, { "from": "r-p1", "to": "r-work", "label": "451 transient", "kind": "error" }, { "from": "r-work", "to": "r-store", "label": "attempt 1 · TRANSIENT", "kind": "async" }, { "from": "r-work", "to": "r-work", "label": "backoff 2^n plus jitter", "kind": "self" }, { "from": "r-work", "to": "r-p1", "label": "submit · attempt 2", "kind": "call" }, { "from": "r-p1", "to": "r-work", "label": "timeout", "kind": "error" }, { "from": "r-work", "to": "r-work", "label": "circuit opens · 5 fails in 30 s", "kind": "self" }, { "from": "r-work", "to": "r-p2", "label": "failover submit · attempt 3", "kind": "call" }, { "from": "r-p2", "to": "r-work", "label": "250 accepted", "kind": "return" }, { "from": "r-work", "to": "r-store", "label": "attempt 3 · SENT via secondary", "kind": "async" }, { "from": "r-work", "to": "r-p1", "label": "half-open probe after 60 s", "kind": "call" }, { "from": "r-p2", "to": "r-work", "label": "550 permanent · mailbox unknown", "kind": "error" }, { "from": "r-work", "to": "r-dlq", "label": "park with full context", "kind": "async" }, { "from": "r-dlq", "to": "r-alert", "label": "DLQ depth breach", "kind": "async" } ], "note": "Transient failures retry then fail over; permanent failures go straight to the DLQ without spending the retry budget. Five attempts over 30 minutes for P1, two over 60 seconds for P0.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "18-deployment-architecture", "title": "Deployment and Failure Domains", "layout": "nested", "canvas": { "width": 1800 }, "boxes": [ { "title": "Primary region · eu-west-1 · active", "kind": "cloud", "dir": "row", "children": [ { "title": "Zone A", "kind": "boundary", "nodes": [ { "id": "p-k8sa", "label": "Kubernetes nodes", "kind": "platform", "sub": "8 × 16 vCPU", "icon": "kubernetes" }, { "id": "p-kfa", "label": "Kafka brokers", "kind": "queue", "sub": "4 × NVMe", "icon": "kafka" }, { "id": "p-pga", "label": "PostgreSQL primary", "kind": "store", "sub": "CloudNativePG", "icon": "postgresql" }, { "id": "p-cha", "label": "ClickHouse shard 1", "kind": "store", "icon": "clickhouse" } ] }, { "title": "Zone B", "kind": "boundary", "nodes": [ { "id": "p-k8sb", "label": "Kubernetes nodes", "kind": "platform", "sub": "8 × 16 vCPU", "icon": "kubernetes" }, { "id": "p-kfb", "label": "Kafka brokers", "kind": "queue", "sub": "4 × NVMe", "icon": "kafka" }, { "id": "p-pgb", "label": "PostgreSQL sync replica", "kind": "store", "sub": "quorum commit", "icon": "postgresql" }, { "id": "p-chb", "label": "ClickHouse shard 2", "kind": "store", "icon": "clickhouse" } ] }, { "title": "Zone C", "kind": "boundary", "nodes": [ { "id": "p-k8sc", "label": "Kubernetes nodes", "kind": "platform", "sub": "6 × 16 vCPU", "icon": "kubernetes" }, { "id": "p-kfc", "label": "Kafka brokers", "kind": "queue", "sub": "4 × NVMe", "icon": "kafka" }, { "id": "p-pgc", "label": "PostgreSQL async replica", "kind": "store", "sub": "read scale", "icon": "postgresql" }, { "id": "p-chc", "label": "ClickHouse shard 3", "kind": "store", "icon": "clickhouse" } ] } ] }, { "title": "DR region · eu-central-1 · warm standby", "kind": "cloud", "dir": "row", "children": [ { "title": "Standby footprint", "kind": "boundary", "nodes": [ { "id": "p-k8sd", "label": "Kubernetes", "kind": "platform", "sub": "30% · scales on promote", "icon": "kubernetes" }, { "id": "p-kfd", "label": "Kafka", "kind": "queue", "sub": "MirrorMaker 2 target", "icon": "kafka" }, { "id": "p-pgd", "label": "PostgreSQL", "kind": "store", "sub": "streaming replica · lag under 5 s", "icon": "postgresql" }, { "id": "p-miniod", "label": "MinIO", "kind": "store", "sub": "cross-region replication", "icon": "minio" }, { "id": "p-vaultd", "label": "Vault replica", "kind": "security", "sub": "performance standby", "icon": "vault" } ] } ] } ], "outside": [ { "id": "p-lb", "label": "Global load balancer", "kind": "integration", "sub": "health-based failover", "icon": "fa5_network_wired" }, { "id": "p-reg", "label": "Harbor registry", "kind": "integration", "sub": "geo-replicated", "icon": "docker" }, { "id": "p-prov", "label": "Channel providers", "kind": "external", "sub": "region-agnostic endpoints", "icon": "fa5_paper_plane" } ], "edges": [ { "from": "p-lb", "to": "p-k8sa", "label": "primary traffic" }, { "from": "p-lb", "to": "p-k8sd", "label": "on promotion · RTO 30 min", "kind": "error" }, { "from": "p-kfa", "to": "p-kfd", "label": "MirrorMaker 2", "kind": "async" }, { "from": "p-pga", "to": "p-pgd", "label": "streaming replication", "kind": "async" }, { "from": "p-pga", "to": "p-pgb", "label": "synchronous commit" } ], "note": "Kafka with replication factor 3 and min.insync.replicas 2 gives RPO 0 in-region for an acknowledged event. Losing one zone costs capacity, not data; losing the region costs at most five minutes of unreplicated events.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "19-cicd-and-environments", "title": "Delivery Pipeline and Environments", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "top", "stages": [ { "title": "Source", "nodes": [ { "id": "b-repo", "label": "GitLab monorepo", "kind": "integration", "sub": "trunk plus MR", "icon": "gitlab" }, { "id": "b-cfg", "label": "Config repository", "kind": "integration", "sub": "rules · templates · quotas", "icon": "gitlab" } ] }, { "title": "Build", "nodes": [ { "id": "b-ci", "label": "GitLab CI", "kind": "app", "sub": "build · unit · lint", "icon": "gitlab" }, { "id": "b-img", "label": "Container image", "kind": "app", "sub": "distroless · reproducible", "icon": "docker" }, { "id": "b-sign", "label": "SBOM and signature", "kind": "security", "sub": "Syft · Cosign", "icon": "fa5_certificate" } ] }, { "title": "Gates", "nodes": [ { "id": "b-test", "label": "Unit and contract", "kind": "decision", "sub": "coverage 80%" }, { "id": "b-vuln", "label": "Vulnerability scan", "kind": "decision", "sub": "no critical", "icon": "fa5_bug" }, { "id": "b-pol", "label": "Policy check", "kind": "decision", "sub": "OPA Gatekeeper", "icon": "fa5_gavel" }, { "id": "b-schema", "label": "Schema compatibility", "kind": "decision", "sub": "Avro backward" } ] }, { "title": "Non-production", "nodes": [ { "id": "b-dev", "label": "dev", "kind": "app", "sub": "auto on merge" }, { "id": "b-stg", "label": "staging", "kind": "app", "sub": "load test 25 k events/s" }, { "id": "b-chaos", "label": "Chaos run", "kind": "app", "sub": "broker kill · provider outage" } ] }, { "title": "Approval", "nodes": [ { "id": "b-gate", "label": "Change gate", "kind": "decision", "sub": "2 approvals · CAB for schema" }, { "id": "b-argo", "label": "Argo CD", "kind": "app", "sub": "GitOps sync · drift alarm", "icon": "argocd" } ] }, { "title": "Production", "nodes": [ { "id": "b-roll", "label": "Argo Rollouts", "kind": "app", "sub": "canary 5% to 100%", "icon": "argocd" }, { "id": "b-slo", "label": "SLO watch", "kind": "decision", "sub": "burn rate under 2×" }, { "id": "b-back", "label": "Automatic rollback", "kind": "app", "sub": "on breach within 10 min" } ] } ], "edges": [ { "from": "b-vuln", "to": "b-ci", "label": "blocked", "kind": "error", "route": "gutter" }, { "from": "b-slo", "to": "b-back", "label": "breach", "kind": "error" }, { "from": "b-cfg", "to": "b-argo", "label": "config only", "kind": "async", "route": "gutter" } ], "note": "Rules and templates ship through the same pipeline as code, so a rule change is versioned, reviewed and revertible. Config-only changes skip the image build but not the gates.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "20-autoscaling-and-capacity", "title": "Autoscaling, Capacity and Backpressure", "layout": "flow", "canvas": { "width": 1800 }, "chain": true, "align": "top", "stages": [ { "title": "Pressure signal", "nodes": [ { "id": "x-lag", "label": "Consumer lag", "kind": "app", "sub": "per topic per tier" }, { "id": "x-depth", "label": "Due-work depth", "kind": "app", "sub": "scheduled backlog" }, { "id": "x-lat", "label": "Provider latency", "kind": "app", "sub": "p95 per vendor" } ] }, { "title": "Controller", "nodes": [ { "id": "x-keda", "label": "KEDA scaler", "kind": "platform", "sub": "lag-driven", "icon": "fa5_expand_arrows_alt" }, { "id": "x-hpa", "label": "HPA", "kind": "platform", "sub": "CPU for stateless APIs", "icon": "kubernetes" }, { "id": "x-flink", "label": "Flink autoscaler", "kind": "platform", "sub": "reactive parallelism", "icon": "flink" } ] }, { "title": "Scaled unit", "nodes": [ { "id": "x-ing", "label": "Ingest API", "kind": "app", "sub": "12 to 90 pods", "icon": "go" }, { "id": "x-rend", "label": "Render Service", "kind": "app", "sub": "20 to 160 pods", "icon": "di2_handlebars" }, { "id": "x-work", "label": "Channel workers", "kind": "app", "sub": "80 to 600 pods", "icon": "fa5_cogs" }, { "id": "x-tm", "label": "Flink task managers", "kind": "app", "sub": "24 to 120", "icon": "flink" } ] }, { "title": "Hard ceiling", "nodes": [ { "id": "x-part", "label": "Partition count", "kind": "queue", "sub": "concurrency ceiling" }, { "id": "x-tps", "label": "Provider TPS", "kind": "external", "sub": "contracted, not elastic", "icon": "fa5_tachometer_alt" }, { "id": "x-pg", "label": "Database connections", "kind": "store", "sub": "PgBouncer pool", "icon": "postgresql" } ] }, { "title": "Backpressure", "nodes": [ { "id": "x-shed", "label": "Shed P2 first", "kind": "decision", "sub": "marketing pauses" }, { "id": "x-429", "label": "429 with Retry-After", "kind": "integration", "sub": "at the gateway", "icon": "envoy" }, { "id": "x-park", "label": "Park to DLQ", "kind": "queue", "sub": "last resort, replayable" } ] } ], "edges": [ { "from": "x-part", "to": "x-shed", "label": "ceiling reached", "kind": "error" }, { "from": "x-tps", "to": "x-shed", "label": "vendor cap", "kind": "error" }, { "from": "x-shed", "to": "x-429", "label": "still over budget", "kind": "error" } ], "note": "Capacity target: 5 000 events/s normal, 25 000 peak, fan-out 1.8, so 45 000 notifications/s peak and roughly 750 M a day. Scaling stops at the partition count, which is why partitions are provisioned for peak and not for today.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "21-observability", "title": "Observability — Signals, Storage and Who Gets Woken", "layout": "grid", "canvas": { "width": 1800 }, "laneHeaderWidth": 175, "columns": [ "Emit", "Collect", "Store", "Consume", "Act" ], "rows": [ { "title": "Metrics", "cells": [ [ { "id": "v-m1", "label": "OpenTelemetry SDK", "kind": "app", "sub": "RED per service", "icon": "opentelemetry" } ], [ { "id": "v-m2", "label": "OTel Collector", "kind": "integration", "icon": "opentelemetry" } ], [ { "id": "v-m3", "label": "Prometheus and Mimir", "kind": "store", "sub": "13 months", "icon": "prometheus" } ], [ { "id": "v-m4", "label": "SLO dashboard", "kind": "platform", "sub": "Grafana", "icon": "grafana" } ], [ { "id": "v-m5", "label": "Page on burn rate", "kind": "security", "sub": "Alertmanager", "icon": "prometheus" } ] ] }, { "title": "Logs", "cells": [ [ { "id": "v-l1", "label": "Structured JSON", "kind": "app", "sub": "event_id · correlation_id" } ], [ { "id": "v-l2", "label": "Fluentd", "kind": "integration", "sub": "PII redaction filter", "icon": "fluentd" } ], [ { "id": "v-l3", "label": "Loki", "kind": "store", "sub": "30 d", "icon": "grafana" } ], [ { "id": "v-l4", "label": "Incident search", "kind": "platform", "icon": "grafana" } ], [ { "id": "v-l5", "label": "Runbook link", "kind": "security" } ] ] }, { "title": "Traces", "cells": [ [ { "id": "v-t1", "label": "W3C tracecontext", "kind": "app", "sub": "propagated on the bus", "icon": "opentelemetry" } ], [ { "id": "v-t2", "label": "OTel Collector", "kind": "integration", "sub": "tail sampling · errors kept", "icon": "opentelemetry" } ], [ { "id": "v-t3", "label": "Tempo", "kind": "store", "sub": "7 d", "icon": "grafana" } ], [ { "id": "v-t4", "label": "Event to provider span", "kind": "platform", "sub": "one trace end to end" } ], [ { "id": "v-t5", "label": "Latency budget alert", "kind": "security" } ] ] }, { "title": "Notification lifecycle", "cells": [ [ { "id": "v-n1", "label": "State transitions", "kind": "app", "sub": "CREATED to DELIVERED" } ], [ { "id": "v-n2", "label": "Receipt topic", "kind": "queue", "icon": "kafka" } ], [ { "id": "v-n3", "label": "ClickHouse", "kind": "store", "sub": "90 d attempts", "icon": "clickhouse" } ], [ { "id": "v-n4", "label": "Notification timeline", "kind": "platform", "sub": "one query per recipient", "icon": "grafana" } ], [ { "id": "v-n5", "label": "Support answer", "kind": "security", "sub": "target under 2 min" } ] ] }, { "title": "Queue and backlog", "cells": [ [ { "id": "v-q1", "label": "Consumer lag", "kind": "app", "sub": "per tier per tenant" } ], [ { "id": "v-q2", "label": "Kafka exporter", "kind": "integration", "icon": "kafka" } ], [ { "id": "v-q3", "label": "Prometheus", "kind": "store", "icon": "prometheus" } ], [ { "id": "v-q4", "label": "Backlog board", "kind": "platform", "sub": "DLQ depth included", "icon": "grafana" } ], [ { "id": "v-q5", "label": "KEDA scale-out", "kind": "security", "sub": "before the page", "icon": "fa5_expand_arrows_alt" } ] ] }, { "title": "Tenant and cost", "cells": [ [ { "id": "v-c1", "label": "Per-tenant counters", "kind": "app", "sub": "sent · failed · suppressed" } ], [ { "id": "v-c2", "label": "OTel Collector", "kind": "integration", "icon": "opentelemetry" } ], [ { "id": "v-c3", "label": "ClickHouse", "kind": "store", "icon": "clickhouse" } ], [ { "id": "v-c4", "label": "Chargeback report", "kind": "platform", "sub": "provider spend per tenant", "icon": "grafana" } ], [ { "id": "v-c5", "label": "Quota enforcement", "kind": "security" } ] ] } ], "note": "The fourth row is the one the requirement asks for by name. Because event_id, notification_id and provider_ref are on the same trace and the same ClickHouse row, why customer X did not receive notification Y is one query, not four systems.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "22-admin-and-operations", "title": "Administration and Operations Surface", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Read — any operator with tenant scope", "kind": "boundary", "dir": "row", "children": [ { "title": "Inspect", "kind": "plain", "nodes": [ { "id": "g-evt", "label": "Event browser", "kind": "app", "sub": "by id · type · window", "icon": "fa5_search" }, { "id": "g-hist", "label": "Notification history", "kind": "app", "sub": "per recipient timeline", "icon": "fa5_stream" }, { "id": "g-fail", "label": "Failure explorer", "kind": "app", "sub": "error class · provider", "icon": "fa5_search" }, { "id": "g-health", "label": "System health", "kind": "platform", "sub": "lag · DLQ · SLO", "icon": "grafana" } ] } ] }, { "title": "Configure — tenant administrator, reviewed change", "kind": "boundary", "dir": "row", "children": [ { "title": "Business configuration", "kind": "plain", "nodes": [ { "id": "g-rules", "label": "Rule management", "kind": "app", "sub": "CEL editor · dry run", "icon": "fa5_project_diagram" }, { "id": "g-tpl", "label": "Template management", "kind": "app", "sub": "draft · publish · roll back", "icon": "fa5_file_alt" }, { "id": "g-pref", "label": "Preference defaults", "kind": "app", "icon": "fa5_sliders_h" } ] }, { "title": "Platform configuration", "kind": "plain", "nodes": [ { "id": "g-prov", "label": "Provider management", "kind": "integration", "sub": "rank · credentials · TPS", "icon": "fa5_paper_plane" }, { "id": "g-retry", "label": "Retry policy", "kind": "app", "sub": "attempts · backoff · budget" }, { "id": "g-flag", "label": "Feature flags", "kind": "platform", "sub": "Unleash · per tenant", "icon": "fa5_toggle_on" }, { "id": "g-quota", "label": "Tenant quotas", "kind": "app" } ] } ] }, { "title": "Dangerous — step-up authentication, four-eyes, always audited", "kind": "trust", "dir": "row", "children": [ { "title": "Recovery actions", "kind": "plain", "nodes": [ { "id": "g-replay", "label": "Event replay", "kind": "risk", "sub": "range capped · second approver" }, { "id": "g-dlq", "label": "DLQ redrive", "kind": "risk", "sub": "batch limited" }, { "id": "g-purge", "label": "PII erasure", "kind": "risk", "sub": "irreversible" }, { "id": "g-pause", "label": "Tenant pause", "kind": "risk", "sub": "stops all sends" } ] } ] } ], "outside": [ { "id": "g-api", "label": "Admin API", "kind": "integration", "sub": "everything the console does", "icon": "openapi" }, { "id": "g-kc", "label": "Keycloak", "kind": "security", "sub": "roles · step-up MFA", "icon": "keycloak" }, { "id": "g-aud", "label": "Audit Log", "kind": "security", "sub": "WORM · 7 y", "icon": "fa5_clipboard_list" } ], "edges": [ { "from": "g-api", "to": "g-kc", "label": "roles" }, { "from": "g-replay", "to": "g-aud", "label": "who · range · count", "kind": "async" }, { "from": "g-purge", "to": "g-aud", "label": "subject · scope", "kind": "async" }, { "from": "g-tpl", "to": "g-aud", "label": "diff", "kind": "async" } ], "note": "The console is a client of the Admin API and has no privileged path of its own. The red row is the reason this view exists: replay at scale can duplicate millions of notifications, so it is gated, capped and audited rather than merely permitted.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "23-operations-loop", "title": "The Operator Loop — From Alert to Answer", "layout": "cycle", "canvas": { "width": 1500 }, "centre": { "label": "Notify Platform", "sub": "SLO 99.9%", "icon": "fa5_bell" }, "nodes": [ { "id": "y-obs", "label": "Observe", "kind": "platform", "sub": "SLO burn · DLQ depth" }, { "id": "y-tri", "label": "Triage", "kind": "app", "sub": "one trace by event_id" }, { "id": "y-cls", "label": "Classify", "kind": "decision", "sub": "provider · config · code" }, { "id": "y-act", "label": "Act", "kind": "app", "sub": "fail over · fix rule · patch" }, { "id": "y-rep", "label": "Replay", "kind": "app", "sub": "scoped range · audited" }, { "id": "y-ver", "label": "Verify", "kind": "platform", "sub": "duplicates suppressed" } ], "ringLabels": [ "alert fires", "one answer, one system", "failure class", "change shipped", "events reprocessed", "backlog clear" ], "note": "Replay closes the loop only because deduplication holds: reprocessing an event range re-decides but does not re-send what was already delivered.", "meta": { "v": "1.0", "owner": "SRE", "date": "2026-08" } }, { "id": "24-security-trust-zones", "title": "Security Architecture — Trust Zones", "layout": "zones", "canvas": { "width": 1800 }, "zones": [ { "title": "Untrusted · internet", "kind": "trust", "nodes": [ { "id": "w-prod", "label": "Producer application", "kind": "external", "icon": "fa5_building" }, { "id": "w-dev", "label": "Recipient device", "kind": "actor", "icon": "fa5_mobile_alt" }, { "id": "w-att", "label": "Attacker", "kind": "risk", "sub": "forged and replayed events" } ] }, { "title": "Perimeter · DMZ", "kind": "trust", "nodes": [ { "id": "w-waf", "label": "WAF and DDoS", "kind": "security", "sub": "per-tenant rps", "icon": "fa5_shield_alt" }, { "id": "w-gw", "label": "Envoy Gateway", "kind": "integration", "sub": "TLS 1.3 · mTLS", "icon": "envoy" }, { "id": "w-tok", "label": "Token validation", "kind": "security", "sub": "Keycloak JWKS", "icon": "fa5_key" } ] }, { "title": "Application · private", "kind": "trust", "nodes": [ { "id": "w-ing", "label": "Ingest API", "kind": "app", "sub": "tenant claim to topic ACL", "icon": "go" }, { "id": "w-dec", "label": "Decision plane", "kind": "app", "sub": "Istio mTLS · no egress" }, { "id": "w-del", "label": "Delivery workers", "kind": "app", "sub": "egress proxy only" } ] }, { "title": "Data · restricted", "kind": "trust", "nodes": [ { "id": "w-kafka", "label": "Apache Kafka", "kind": "queue", "sub": "SASL · ACL per tenant", "icon": "kafka" }, { "id": "w-pg", "label": "PostgreSQL", "kind": "store", "sub": "RLS · encrypted volumes", "icon": "postgresql" }, { "id": "w-pii", "label": "PII Vault", "kind": "store", "sub": "per-tenant data key", "icon": "fa5_user_lock" }, { "id": "w-aud", "label": "Audit Log", "kind": "security", "sub": "WORM · 7 y", "icon": "fa5_clipboard_list" } ] }, { "title": "Identity and secrets", "kind": "trust", "nodes": [ { "id": "w-kc", "label": "Keycloak", "kind": "security", "sub": "OIDC · client credentials", "icon": "keycloak" }, { "id": "w-vault", "label": "HashiCorp Vault", "kind": "security", "sub": "1 h dynamic leases", "icon": "vault" }, { "id": "w-spire", "label": "SPIRE", "kind": "security", "sub": "workload SVID", "icon": "fa5_fingerprint" } ] } ], "edges": [ { "from": "w-prod", "to": "w-waf", "label": "HTTPS · mTLS" }, { "from": "w-att", "to": "w-waf", "label": "replay rejected", "kind": "error" }, { "from": "w-dev", "to": "w-waf", "label": "WSS" }, { "from": "w-waf", "to": "w-gw", "label": "TLS 1.3" }, { "from": "w-gw", "to": "w-tok", "label": "JWT verify" }, { "from": "w-tok", "to": "w-ing", "label": "tenant claim" }, { "from": "w-ing", "to": "w-kafka", "label": "SASL · ACL", "kind": "async" }, { "from": "w-dec", "to": "w-pg", "label": "mTLS · RLS" }, { "from": "w-del", "to": "w-pii", "label": "scoped read" }, { "from": "w-spire", "to": "w-dec", "label": "SVID" } ], "note": "Producers never hold a provider credential — the platform leases them per tenant from Vault. Events carry a subject reference rather than PII, so a compromised producer token leaks routing metadata and not contact data.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-08" } }, { "id": "25-identity-and-token-flow", "title": "Identity and Access — Producer Authentication", "layout": "sequence", "canvas": { "width": 1760 }, "lifelines": [ { "id": "f-prod", "label": "Producer workload", "kind": "external", "icon": "fa5_building" }, { "id": "f-spire", "label": "SPIRE Agent", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "f-kc", "label": "Keycloak", "kind": "security", "icon": "keycloak" }, { "id": "f-gw", "label": "Envoy Gateway", "kind": "integration", "icon": "envoy" }, { "id": "f-ing", "label": "Ingest API", "kind": "app", "icon": "go" }, { "id": "f-kafka", "label": "Kafka", "kind": "queue", "icon": "kafka" }, { "id": "f-vault", "label": "Vault", "kind": "security", "icon": "vault" } ], "messages": [ { "from": "f-prod", "to": "f-spire", "label": "attest workload", "kind": "call" }, { "from": "f-spire", "to": "f-prod", "label": "X.509 SVID · 1 h", "kind": "return" }, { "from": "f-prod", "to": "f-kc", "label": "client_credentials grant", "kind": "call" }, { "from": "f-kc", "to": "f-prod", "label": "JWT · tenant_id · scopes · 15 min", "kind": "return" }, { "from": "f-prod", "to": "f-gw", "label": "POST /v1/events · mTLS plus bearer", "kind": "call" }, { "from": "f-gw", "to": "f-gw", "label": "SPIFFE ID against tenant allow-list", "kind": "self" }, { "from": "f-gw", "to": "f-kc", "label": "JWKS · cached 10 min", "kind": "call" }, { "from": "f-gw", "to": "f-ing", "label": "forward with verified claims", "kind": "call" }, { "from": "f-ing", "to": "f-ing", "label": "scope events:write · tenant match", "kind": "self" }, { "from": "f-ing", "to": "f-vault", "label": "lease database credential · 1 h", "kind": "call" }, { "from": "f-vault", "to": "f-ing", "label": "dynamic credential", "kind": "return" }, { "from": "f-ing", "to": "f-kafka", "label": "produce as tenant principal", "kind": "call" }, { "from": "f-kafka", "to": "f-ing", "label": "ACL denied · wrong tenant topic", "kind": "error" }, { "from": "f-ing", "to": "f-prod", "label": "202 Accepted · event_id", "kind": "return" } ], "note": "No long-lived secret is issued to a producer. The mTLS identity proves the workload, the JWT carries the tenant, and Kafka enforces the same tenant a second time so a bug in the API cannot cross a tenant boundary.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-08" } }, { "id": "26-resilience-and-failure-modes", "title": "Failure Modes and Disaster Recovery", "layout": "nested", "canvas": { "width": 1800 }, "boxes": [ { "title": "Infrastructure failure — red is the failure, the label is the cover", "kind": "boundary", "dir": "row", "children": [ { "title": "Compute and storage", "kind": "plain", "nodes": [ { "id": "u-node", "label": "Node loss", "kind": "risk", "sub": "PDB plus reschedule" }, { "id": "u-broker", "label": "Broker loss", "kind": "risk", "sub": "RF 3 · min.insync 2" }, { "id": "u-az", "label": "Zone loss", "kind": "risk", "sub": "3 zones · quorum holds" }, { "id": "u-region", "label": "Region loss", "kind": "risk", "sub": "warm DR · RTO 30 min" } ] }, { "title": "Stateful services", "kind": "plain", "nodes": [ { "id": "u-pg", "label": "PostgreSQL primary loss", "kind": "risk", "sub": "auto failover under 30 s" }, { "id": "u-flink", "label": "Flink job failure", "kind": "risk", "sub": "checkpoint restore 60 s" }, { "id": "u-temporal", "label": "Temporal outage", "kind": "risk", "sub": "immediate path unaffected" }, { "id": "u-redis", "label": "Redis loss", "kind": "risk", "sub": "dedup fails open · duplicates over loss" } ] } ] }, { "title": "Dependency failure", "kind": "boundary", "dir": "row", "children": [ { "title": "Providers", "kind": "plain", "nodes": [ { "id": "u-p1", "label": "Provider outage", "kind": "risk", "sub": "circuit opens · secondary" }, { "id": "u-pall", "label": "Both vendors down", "kind": "risk", "sub": "park in DLQ · replay" }, { "id": "u-thr", "label": "Provider throttling", "kind": "risk", "sub": "adaptive TPS · P2 shed" } ] }, { "title": "Internal services", "kind": "plain", "nodes": [ { "id": "u-tpl", "label": "Template Service down", "kind": "risk", "sub": "last published cached" }, { "id": "u-cfg", "label": "Config Service down", "kind": "risk", "sub": "rules held in Flink state" }, { "id": "u-crm", "label": "Customer Master down", "kind": "risk", "sub": "24 h profile cache" }, { "id": "u-poison", "label": "Poison message", "kind": "risk", "sub": "3 strikes then DLQ" } ] } ] } ], "outside": [ { "id": "u-tool", "label": "Recovery tooling", "kind": "app", "sub": "Replay Service · DLQ console", "icon": "fa5_history" }, { "id": "u-bk", "label": "Backup", "kind": "store", "sub": "PITR 7 d · cross-region", "icon": "minio" }, { "id": "u-game", "label": "Game day", "kind": "platform", "sub": "quarterly · these exact modes", "icon": "fa5_flask" } ], "edges": [ { "from": "u-pall", "to": "u-tool", "label": "redrive when healthy", "kind": "error" }, { "from": "u-poison", "to": "u-tool", "label": "inspect and fix", "kind": "error" }, { "from": "u-region", "to": "u-bk", "label": "restore path", "kind": "error" }, { "from": "u-game", "to": "u-tool", "label": "exercises quarterly", "kind": "batch" } ], "note": "RPO 0 in-region for an acknowledged event, RPO 5 min cross-region, RTO 30 min. The one accepted trade-off is drawn in the second box: if Redis is lost, deduplication fails open and the platform sends duplicates rather than dropping notifications.", "meta": { "v": "1.0", "owner": "SRE and Security Architecture", "date": "2026-08" } } ]