Spot Capacity Orchestrator · View 31 of 32 · 7 · Assurance
Decisions
- Moving work from reclaimable to guaranteed capacity is treated as spending money, because it is. The approver must be named in the contract, sign in with a phishing-resistant factor, and approve a priced option rather than a vague request.
- Every capacity action records the identity that caused it: an operator, a policy, or a policy acting under a named approval. The record goes to the audit log service through an outbox, independent of Kafka and ClickHouse.
Separation of authority
- Routine contract edits need the platform team's review. Floors, spend caps and fallback policy need a governance signature as well. Operators of the orchestrator cannot approve their own fallback spend.
Risk
- A budget owner who never answers at night turns every broad shortage into a recorded shortfall. That is the chosen failure; the review after each one decides whether the cap was simply too low.
