URL Shortener & Link Management Service  ·  View 06 of 23  ·  People and journeys

Journey — Killing a Link That Is Already Out There

The journey the whole revocation design exists to serve, and the one place where caching and safety pull in opposite directions.

Editable source SVG draw.io All views
Trust and safety analyst with the customer watching Goal — Make a live, distributed link stop redirecting, everywhere, now Trigger — An abuse report, or a feed flipping an approved destination to malicious Done when — Clicks stop within the minute, and the decision is defensible afterwards 1 · Hear report or feed 2 · Judge ◆ moment of truth 3 · Kill ◆ moment of truth 4 · Prove 5 · Appeal What they do Takes the report Reviews the destination Presses block Writes the finding Handles the owner's appeal What the platform does Report intake + triage Feed scores and history Deny-set push ≤ 60 s Feed, score, actor stored Reinstate on the same path How it feels In control Neutral Exposed Where it hurts No idea of the blast radius False positive costs a customer Edge caches may still serve Owner cannot see why What answers it Live click rate per code Interstitial, not deletion 30 s cache TTL bounds it Immutable audit record Reason shown to the owner Journey — Killing a Link That Is Already Out There This journey is the reason revocation has its own propagation channel: the analyst's 60 seconds cannot wait behind a five-minute projection. v 1.0 · owner Platform Architecture · date 2026-09

Why revocation is architectural

  • The analyst's minute cannot wait behind a five-minute projection, so revocation gets its own channel and its own published bound (ADR-02).
  • Blocking is not deletion: the code stays, the evidence stays, and the response becomes a platform interstitial so the clicker is warned rather than confused.
  • Reinstatement runs the same path, which means the appeal case is a first-class flow rather than a manual database edit.

The tension, stated

  • A cached 302 at the edge can keep serving a killed link until its TTL expires. That is why the TTL is 30 s and why raising it for hit rate is a safety decision, not a tuning one.
  • Assumption: 30 s edge TTL, 5 s regional deny-set pull, 60 s p99 end-to-end — the three numbers that together make the promise, and the first ones real traffic should challenge.

Evidence

  • Every block records the feed, the score, the reviewer and the time; every reinstatement does the same. An abuse decision with no record is indistinguishable from an outage.
◀  Journey — Launching a Printed Link All views Layered Architecture  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records06-journey-kill-a-live-link