AUD amount modelling
The client can propose a price, but the server must authorise it
Amount validation includes who may choose the inputs and change the result. Correct decimal arithmetic does not protect an endpoint that trusts an editable browser total.
In this article
Identify the authoritative inputs
A browser can display a quotation and submit selected products, quantities or an approved quote reference. The server should obtain authoritative rates and apply the relevant policy before creating a charge.
Do not trust a hidden total field because the interface prevents ordinary editing. Requests can be constructed independently of the screen. Validate both the input values and the user's authority to select them.
For negotiated pricing, model the approved quote or override explicitly. The server needs evidence of the permitted amount rather than an exception that accepts any client-supplied total.
Separate editing from approval
Define who may alter rates, apply discounts, issue credits and change calculation policy. These actions have different consequences and may require different roles in the business workflow.
Record the actor, original value, new value and reason for an authorised override. A generic Updated transaction event is insufficient when a reviewer needs to understand why the payable amount changed.
Protect cross-organisation references. A user must not submit another customer's approved quote ID to obtain its price or expose its details.
Keep diagnostics proportionate
Calculation debugging often needs exact inputs, but not every support log needs customer names or full transaction contents. Use identifiers and restricted diagnostic access where possible.
Review exports and analytics separately. A broadly accessible operational dashboard can reveal commercially sensitive rates even if the payment endpoint itself is well protected.
Retain calculation evidence according to the business's approved records policy. Avoid inventing a universal retention period for all financial data and jurisdictions.
Test an altered request
Capture a synthetic valid request and change its total, currency, discount and quote reference independently. The server should reject unauthorised combinations or recompute the authoritative amount with a clear result.
Then exercise a permitted override through its proper role and verify the audit record. Security testing should demonstrate both the denial path and the legitimate workflow, so controls do not force staff into undocumented workarounds.
Finally, replay the request under the same business identity. Authorisation and amount correctness should remain consistent with the operation's duplicate-handling contract rather than creating another charge.
Primary sources
Stripe: currency and amount representationReferences checked 11 September 2026.