Two cards, one balance, and the network gave us one chance
A company issues payment cards to its customers' employees. The money is not preloaded onto the cards — it sits in the company's own system, and the company decides at the moment of the tap whether to release it.
Two employees on the same account tapped in different cities in the same second. Both were approved against the same funds. The week before, a slow afternoon in the spend-policy service had turned into a run of declines nobody could explain, on cards with plenty of money behind them.
- R1When a card is presented, we decide while the transaction is waiting. There is exactly one chance to answer, inside the conversation the network opened — no answering later, no picking it up again. Every hop between the request arriving and the answer leaving is spending one budget, not starting a fresh clock of its own.
- R2Two cards on the same account can be presented at the same instant, in different countries, and must not both be approved against the same funds. Checking the balance and committing against it cannot be two moments with a gap between them, because that gap is where both requests see the same money.
- R3Deciding requires calling our own spend-policy service. That service being slow must not spend the one chance we have to answer. A call we decline to make at all is cheaper than a call we start and abandon, because the abandoned one has already spent the time.
Outside every boundary: Spend policy (rules per card), Ledger (held then settled), Clearing, reversals (arrive later), Decision service (policy and funds), Card network (carries the ask), Issuer processor (must answer now), an empty slot for the how the ask is answered, tier 1, an empty slot for the what says there is money, tier 1, an empty slot for the in front of the policy call, tier 2 Connections: Card network calls Issuer processor — authorization Issuer processor calls how the ask is answered — fund this? how the ask is answered calls Decision service — decide Decision service calls what says there is money — hold it Decision service calls in front of the policy call — ask policy in front of the policy call calls Spend policy — rules Issuer processor publishes to Clearing, reversals — afterwards Clearing, reversals publishes to Ledger — reconciled