Payment Checkout & Ledger Service  ·  View 23 of 24  ·  Assurance

Identity and Access — Who May Move Money

Fifteen messages, and no sequence in which one authenticated human changes the books.

Editable source SVG draw.io All views
Finance operator Workforce IdP Ops console Dual-control service Second approver Ledger Immutable audit HSM 1. phishing-resistant MFA 2. assertion + role 3. session opened 4. view payment (masked) 5. read + case ref 6. propose correction 7. queue for approval 8. approval request 9. approve (different human) 10. sign the instruction 11. signature 12. opposite-signed txn 13. balance check, append 14. both approvers recorded 15. no single-actor path Identity and Access — Who May Move Money There is no sequence in which one authenticated human changes the books. Elevation to unmasked data is itself a logged, case-referenced event. v 1.0 · owner Payments Platform Architecture · date 2026-10

Decisions

  • Dual control is a service in the path, not a policy in a document. The proposal and the approval are separate authenticated acts by different humans (ADR-14).
  • The instruction is signed in the HSM, so the approval is cryptographic evidence rather than a database row somebody could write.
  • Amounts and identifiers are masked by default; elevation to unmasked data is itself a logged, case-referenced event.

Decisions

  • Workforce access requires phishing-resistant MFA. A payments back office is a credential-phishing target by definition.
  • Every read of payment data by a human is audited with the support case that justified it — the control that makes 'who looked at this' answerable.

Risks

  • Dual control is only as strong as the separation between the two humans. Two operators on the same shift under the same pressure are a single control in practice, and that is an organisational risk this architecture cannot fix.
◀  Trust Zones and What Crosses Them All views Failure Classes — What Is Assumed To Fail  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes across two in-country data centres · Payments Platform Architecture · 2026-10 · 24 views · 18 architecture decision records23-credential-and-key-flow