The workspace member is the design centre: every other actor's work may cost them cost or capacity, none may cost them perceived latency on a small file
The tenant security admin is a first-class user, not an admin afterthought — the quarantine console is a product surface with its own latency and clarity targets
Machines are actors with lanes: the sync daemon and the migration job get admission limits and failure paths exactly as a human journey does, which is what stops a weekend migration starving a Monday attachment
The actor most designs omit
The external submitter — a stranger uploading to a form — has no account, no history and no reason to be trusted, and is the single most likely source of a malicious object
Serving them well and trusting them least at the same time is the requirement that produces the two-plane storage split
The re-scan scheduler is also an actor: it is the only one whose job is to disagree with a decision the platform already made
Stated assumptions
Volumes are assumed for a 40 M MAU collaboration SaaS, not measured
Twelve product tenants, each with its own destination scopes and policy
A 24×7 platform security rota exists and owns break-glass
