Usage Metering & Billing Pipeline  ·  View 21 of 22  ·  Assurance

Identity and Entitlement Flow

Who proves what, in what order, and what happens when the cap check cannot answer.

Editable source SVG draw.io All views
Product service Workload identity Entitlement service Balance ledger Customer admin Usage API Aggregate store 1. assume role 2. token scoped to its meters 3. may this account use this meter? 4. cache read, p99 10 ms 5. balance on cache miss 6. remaining grant 7. allow or deny, with headroom 8. unavailable — fail open, marked 9. GET /usage, OIDC session 10. account-scoped authorisation 11. read this account only 12. quantities with freshness Identity and Entitlement Flow — Who Proves What Message 8 is the decision in the ask's Question 3: the cap check fails open and records that it did, so the overshoot is known rather than invisible. v 1.0 · owner Architecture Practice · date 2026-10

The open decision

  • Message 8 is question 3 of the requirement, answered one way and marked: the cap check fails open and records that it did, so the overshoot is known rather than invisible. The alternative — fail closed — trades unbillable usage for refusing a paying customer's request during a billing outage.
  • The token is scoped to the producer's own meters, so authorisation is a property of the identity rather than a check in application code.
  • The customer read path is authorised per account before any store is touched, not filtered after.

Assumptions

  • Cap decision p99 ≤ 10 ms in-region with a better-than-95% cache hit rate (stated assumptions). If either is wrong, synchronous caps are not viable and enforcement becomes asynchronous.
  • Entitlement availability ≥ 99.99% monthly, because the serving path may depend on it (stated assumption).

Risks

  • Fail-open means a long entitlement outage produces usage nobody is entitled to. Bounding it needs a secondary local limit in the producer, which is not in the MVP.
  • A balance read on cache miss puts the balance ledger on the request path at the worst possible moment: when the cache is cold after a deployment.
◀  Security Zones and Privileged Paths All views Failure Classes  ▶
Solution Architecture v1.0 · Amazon Web Services · Billing Platform Architecture · 2026-1021-entitlement-and-identity-flow