Change compensation rules while workflows remain active
Old sagas may have committed effects under an earlier contract. Version the recovery logic and decide how those records continue before deploying new rules.
Read articleCobnex blogs / Australia
Cobnex blog
AI implementation, software architecture, cloud operations and Australian technology policy.
100 articles in Software architecture
Page 4 of 6
Migrate tenant data without weakening the shared boundary
Moving one tenant between stores changes routing, ownership and background work. Keep an authoritative location and explicit cutover rules throughout the transition.
Read articleRelease the consumer before requiring the new event field
Plan the period when old and new producers coexist. A new field becomes safe only when every relevant reader handles both its presence and its absence.
Read articleChange cache formats without breaking older application instances
Rolling releases can read and write the same cache at once. Separate incompatible formats and plan the load created when the new namespace starts empty.
Read articleRemove the old column in a later release
Keeping an unused field briefly can preserve rollback. Drop it only after readers, writers and recovery tools have stopped depending on it.
Read articleEvery writer must join the new concurrency protocol
Adding revision checks to one endpoint leaves older jobs able to overwrite it. Roll out the protection across the complete set of writers.
Read articleShared database access is still an authority decision
Modules in one application may share infrastructure without sharing unrestricted permission to mutate every table. Make data ownership and enforcement explicit.
Read articleScope the publisher to the events it must deliver
The outbox worker needs access to event records and approved destinations. It does not automatically need unrestricted access to the source application's data.
Read articleKeep idempotency keys inside the correct account scope
A retry key identifies an intention, not a user. Authenticate the caller and scope result lookup so one account cannot retrieve or suppress another account's operation.
Read articleReview access when a response gains new fields
An additive field can expose information to every existing caller. Evaluate its audience and data meaning before treating it as a harmless schema extension.
Read articleCompensation requires its own permission checks
A corrective action can release resources, reverse a commitment or notify a customer. Give it explicit authority rather than treating recovery as an unrestricted system privilege.
Read articleDo not trust the tenant label supplied by the client
A tenant identifier selects a context. The server must establish whether the authenticated caller may use it and whether the target belongs inside it.
Read articleAn event payload is also a data disclosure
Publishing a field creates another accessible copy. Review subscribers, replay tools and retention before adding personal or commercially sensitive information.
Read articleAuthorisation must survive a cache hit
Reusing data must not reuse another caller's authority. Review access checks before and after the point where a cached value enters the response.
Read articleA migration role should not become the application's login
Schema changes may require privileges that ordinary requests do not. Keep that authority scoped to the release process and remove temporary access afterwards.
Read articleRecheck authority when a concurrent change affects permission
A valid session does not guarantee that the requested action remains permitted. Keep the access decision consistent with the state being changed.
Read articleCompare one deployable application with several operated services
Service boundaries add independent control and operational work. Compare the cost of the problem being solved with the cost of running the split.
Read articleBudget for backlog recovery as well as ordinary traffic
A publisher sized only for normal arrivals may never catch up after an outage. Estimate spare throughput and protect the database while draining delayed work.
Read article