Two surfaces, one access model
- Problem
- A cross-border payment fails in ways the customer cannot see: a vendor queue, a compliance hold, a corridor that closed at four in the afternoon local time. Support has to answer for it in minutes, and the customer has to be able to act on the answer.
- Decision
- The client platform and the internal admin were built as one system on a shared access model, role-based from its first draft. Same data, two audiences, different permissions rather than different truths.
- Tradeoff
- Every product change then lands twice, and the surfaces have been rewritten several times since. Each rewrite happened because the model had outgrown the screens, never the other way round.