The customer admin and the customer finance owner are modelled separately because they want different artefacts: one wants a forecast, the other wants evidence. Collapsing them produces a usage dashboard that no auditor can use.
The pricing manager is a first-class actor with a self-service path, which is what forces pricing to be versioned configuration rather than code.
The external auditor is in the cast. If verification by an untrusting third party is not a goal, most of the retention and provenance cost in this design is unjustified.
What this forces
A provisional figure must be labelled as provisional, because the admin's goal is prediction and the finance owner's is reconciliation.
Every invoice line must expand to its events, because three of the nine actors need that and none of them can be told to trust the number.
The product engineer's goal — see within minutes whether events are being billed — is why per-producer acceptance reporting exists at all.
Risks
Nine actors on one platform is a wide surface for authorisation mistakes; view 20 holds the answer and view 21 the mechanism.
Two of the three privileged actions belong to internal actors under month-end time pressure, which is exactly when a second approver is most resented and most necessary.
