File 17
Operational controls
10 records, read from 3-operational-controls.
| Control | Minimum implementation |
|---|---|
| Idempotency | Stable key from tenant + workflow + target + source + planned interval; unique database constraint |
| Retry | Error taxonomy, exponential backoff with jitter, per-source retry budget, no policy-denial retry |
| Rate limiting | Connector token bucket plus global domain concurrency cap |
| Circuit breaker | Pause source after repeated blocks, anomalous payloads, or terms change |
| Dead-letter | Preserved event, failure class, attempts, last error, policy context, safe replay button |
| Timeouts | Request, parse, model, workflow, and reviewer expiry separately bounded |
| Concurrency | Per source, tenant, target, and expensive model; never unbounded fan-out |
| Checkpointing | After capture, normalization, claim review, estimate run, and activation |
| Compensation | Remove/restrict projections after retraction, opt-out, or failed activation |
| Kill switch | Disable source, connector, tenant, campaign, or all collection independently |