URL Shortener & Link Management Service  ·  View 16 of 23  ·  Runtime

Critical Flow — Stopping a Link in Under a Minute

The promise the platform is most likely to be judged on, and the cache TTL that bounds it.

Editable source SVG draw.io All views
Reputation feed Analyst Review service Link table Revocation publisher Regional deny-set Front Door PoP 1. approved destination now flagged 2. queue item with score and live click rate 3. block, with reason 4. state = blocked, evidence stored 5. publish revocation delta 6. delta to 12 regions (pull every 5 s) 7. in-process set updated before next request 8. cached 302 may still serve for up to 30 s 9. on expiry, next miss hits the deny-set 10. blocked — interstitial, no-store 11. effective globally, ≤ 60 s p99 12. reinstate on appeal, same path Critical Flow — Stopping a Link in Under a Minute The 30-second edge cache TTL is what bounds the worst case, which is why it is a design parameter rather than a tuning knob: raising it for hit rate directly weakens this promise. v 1.0 · owner Platform Architecture · date 2026-09

How the minute is spent

  • Decision → link state written → revocation delta published → regional deny-sets pull within 5 s → edge caches expire within 30 s. The 60 s p99 is the sum, not a target hoped for.
  • The deny-set is matched before any cache layer, so a region that has the delta stops serving immediately regardless of what its hot set holds.
  • Reinstatement runs the identical path, which is what makes the appeal flow trustworthy rather than a favour.

Stated honestly

  • For up to 30 seconds, a cached 302 at a PoP may still redirect a blocked link. The platform publishes this rather than claiming instant global blocking.
  • Purging the edge cache per code is the alternative to waiting out the TTL; it is deliberately not on the critical path because a purge fan-out is a slower and less predictable mechanism than an expiry.

Evidence and recourse

  • Feed, score, reviewer and time are stored for every block and every reinstatement, retained 2 years.
  • The owner sees the reason in the console. A link that stops working with no explanation is the failure mode this flow exists to prevent.
◀  Critical Flow — Claiming a Code All views Click Analytics Pipeline  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records16-revocation-and-abuse-block