A financial operations platform handles customer cases.
Cases can be created, assigned, escalated, investigated, resolved, audited, searched, and notified.

POST /cases/{caseId}/escalations
Idempotency-Key: 9d617...
Authorization: Bearer ...
Content-Type: application/json

202 Accepted
Location: /operations/op-123

{
  "operationId": "op-123",
  "caseId": "CASE-100",
  "status": "ACCEPTED",
  "committed": [
    "case_escalation",
    "outbox_event"
  ],
  "pending": [
    "notification",
    "search_projection",
    "workflow_steps"
  ]
}

case state committed before response
notification/search/workflow eventually complete

operation: CreateEscalation
method: POST
route: /cases/{caseId}/escalations

idempotency:
  required: true
  header: Idempotency-Key
  duplicateSamePayload: returnOriginalResult
  duplicateDifferentPayload: 409

timeouts:
  gatewayMs: 1500
  meshMs: 1400
  serviceBudgetMs: 1200
  dbMs: 300
  riskServiceMs: 250

retries:
  gateway: disabled
  mesh: disabled
  client: allowedOnlyWithSameIdempotencyKey

auth:
  gateway: oidc-jwt
  service: domain authorization

validate command
check authorization
load case aggregate
apply escalation
insert idempotency record
insert case state change
insert outbox event
commit transaction
return 202

if case state commits, outbox row commits
if transaction rolls back, no event row exists

@Transactional
public OperationResult escalate(EscalateCaseCommand command) {
    idempotency.checkOrReserve(
        command.idempotencyKey(),
        command.requestHash()
    );

    CaseAggregate caze = cases.getForUpdate(command.caseId());

    authorization.requireCanEscalate(command.user(), caze);

    DomainEvent domainEvent = caze.escalate(
        command.reason(),
        command.targetQueue(),
        command.comment()
    );

    cases.save(caze);

    CaseEscalatedEvent event = eventMapper.toEvent(domainEvent);

    outbox.insert(OutboxMessage.of(
        event.eventId(),
        "case-events",
        event.caseId(),
        event.eventType(),
        event.schemaVersion(),
        event.payload(),
        event.headers()
    ));

    OperationResult result = OperationResult.accepted(
        command.operationId(),
        command.caseId()
    );

    idempotency.complete(command.idempotencyKey(), result);

    return result;
}

case-events

caseId

{
  "eventId": "evt-123",
  "eventType": "CaseEscalated.v1",
  "occurredAt": "2026-07-05T10:15:30Z",
  "caseId": "CASE-100",
  "aggregateVersion": 42,
  "reason": "HIGH_RISK_ACTIVITY",
  "targetQueue": "FRAUD_REVIEW"
}

event_id=evt-123
event_type=CaseEscalated.v1
correlation_id=corr-123
causation_id=cmd-456
producer=case-service
schema_id=case-escalated-v1

consumer: search-indexer
topic: case-events
groupId: search-indexer
autoCommit: false
ackAfterDurableProjectionWrite: true
idempotency: processed-message-table
orderingScope: caseId
sequenceGapPolicy: retry-then-park
freshnessSloP99Seconds: 30

consumer: notification-service
sideEffect: send notification
idempotency:
  notificationId: eventId + channel
providerIdempotencyKey: notificationId
retry:
  bounded: true
  backoff: exponential-jitter
replay:
  sideEffectsSuppressedByDefault: true

CaseEscalated -> create EscalationWorkflow
EscalationWorkflow -> request risk review
RiskReviewed -> assign queue
QueueAssigned -> notify team
Timeout -> manual intervention

dependency: risk-service
protocol: grpc
method: ScoreCaseRisk
deadlineMs: 250
retry:
  enabled: false
fallback:
  markRiskScorePending: true
metadata:
  correlationId: required
mesh:
  mtls: strict
  authz: case-service may call risk-service

route: /cases/**
host: api.example.com
auth: oidc-jwt
tls: terminate-at-gateway
rateLimit:
  by: clientId
  default: 1000/min
bodyLimitBytes: 1048576
timeouts:
  requestMs: 1500
retries:
  methods: [GET, HEAD]
  maxAttempts: 2

mesh:
  mtls: strict
  authorization:
    case-service:
      allowFrom:
        - edge/api-gateway
        - order/order-service
    risk-service:
      allowFrom:
        - case/case-service

externalDependency: email-provider
viaEgressGateway: true
auth: oauth-client-credentials
timeoutMs: 1000
retry:
  maxAttempts: 3
  idempotencyKeyRequired: true
circuitBreaker:
  enabled: true

topology: active-active-read-single-writer-write
ownership:
  owner: tenantRegion
writes:
  routeToOwnerRegion: true
  crossRegionRetryForCommands: forbidden
reads:
  localProjectionAllowed: true
  staleReadMaxSeconds: 60
failover:
  writeFailoverRequiresOwnershipTransfer: true
  fencingTokenRequired: true

http.server.requests{service,operation,status}
http.client.requests{dependency,operation,status}
grpc.client.calls{service,method,status}
outbox.oldest_pending_age.seconds
messaging.consumer.lag.seconds
messaging.dlq.messages.total
case.escalation.workflow.duration
search.projection.freshness.seconds
gateway.requests.total{route,status}
mesh.authz.denied.total
egress.requests.total{provider,status}

productionReadiness:
  decision: ready-with-conditions
  blockers: []
  conditions:
    - complete DLQ replay drill before GA
    - enable projection freshness SLO alert before 100% rollout
  acceptedRisks:
    - search projection may be stale up to 60s during replay
    - notification provider outage leaves notification pending
  rollout:
    phase1: internal tenant
    phase2: 5% production traffic
    phase3: 25%
    phase4: 100% after 7 days stable
  rollback:
    gatewayRouteRollback: true
    producerFeatureFlag: true
    consumerPause: true

Who is calling?
What contract applies?
What state changes?
What is committed before response?
What can be duplicated?
What can be delayed?
What can fail?
Who retries?
Who owns timeout?
Who authorizes?
Who observes?
Who operates?
Who recovers?

communication is not transport
communication is distributed correctness