Architecture & reliability
Core services are understood, but customer-flow reliability is not measured end to end.
Public example / fictional company
Illustrative Fintech Engineering Scale & AI Readiness Assessment
A complete fictional example showing how payment, reliability, delivery, security, organization, AI, and diligence evidence becomes a ranked 90-day plan.
Recommended decision
Proceed with one corridor only after protecting transaction-state invariants, installing business-flow reliability signals, and bounding the AI support workflow. Defer a broad platform rewrite.
Context and trigger
A Seed-stage cross-border payments company is preparing to add two corridors while introducing an AI-assisted support workflow. Leadership needs to decide which controls must precede expansion and which platform work can wait.
Illustrative scope
- One representative remittance corridor and its timeout, retry, reconciliation, and refund paths.
- One retrieval-augmented customer-support workflow with escalation to a human agent.
- Five interviews across executive, engineering, operations, support, and security responsibilities.
- A baseline across eight dimensions with deep dives in payments/reliability and AI controls.
Evidence inspected
- Architecture and payment-state diagrams
- Provider timeout and retry configuration
- Reconciliation exceptions and incident records
- Service dashboards, alerts, and operational runbooks
- Delivery metrics, roadmap, and ownership map
- RAG evaluation set, prompt controls, model fallback, and escalation flow
Workflows under review
Payment workflow
Customer request → payment service → provider → webhook → ledger state → reconciliation → settlement/refund
+
AI support workflow
Support question → retrieval → policy context → model answer → confidence/control gate → human escalation
Readiness score
48 / 100
Equal weighting across eight dimensions. Selected deep dives change evidence depth, not scoring weight.
Payments & ledger controls
Retry and reconciliation behavior permits ambiguous transaction state.
Delivery system
Deployment is repeatable; cross-team dependencies remain difficult to forecast.
Incident management
Technical symptoms are reviewed, but financial and customer consequences are not consistently classified.
Security & SOC 2 readiness
Baseline controls operate; AI-specific access and prompt-injection boundaries remain untested.
Hiring & team structure
Leadership coverage is credible, with fragmented decision rights across corridor expansion.
AI development practices
Evaluation, fallback, and permission controls are not sufficient for market expansion.
Technical diligence
Evidence exists, but it is distributed across owners and cannot yet support a concise diligence narrative.
Prioritized risk register
F-01 / Payments & ledger controls
A provider timeout followed by an application retry can leave transaction state ambiguous across the payment service and reconciliation process.
Confidence: High
Evidence inspected
Sequence review shows the provider request can succeed after the local timeout while the retry receives a second reference.
Consequence
Duplicate movement or delayed customer resolution can appear when the next corridor increases timeout variance.
Action
Define idempotency, state-transition, and reconciliation invariants before enabling the next corridor.
Owner
Payments lead
Completion evidence
Every timeout path resolves to one canonical financial state in an automated replay test.
F-02 / Payments & ledger controls
Reconciliation exceptions share one queue without explicit financial-risk classification or aging ownership.
Confidence: High
Evidence inspected
Exception export contains provider mismatch, delayed settlement, and duplicate-reference cases under the same operational status.
Consequence
Material exceptions can age behind low-risk operational noise.
Action
Classify exceptions by financial exposure, assign aging targets, and publish a daily owner view.
Owner
Payments operations
Completion evidence
High-risk exceptions have an owner within one business hour and no unexplained aging beyond the agreed threshold.
F-03 / Architecture & reliability
Logs and infrastructure alerts do not produce SLOs for authorization, funding, settlement, or reconciliation outcomes.
Confidence: High
Evidence inspected
Dashboards report service health and latency but cannot quantify completion or correctness for a customer payment flow.
Consequence
Leadership cannot distinguish acceptable service health from customer-impacting financial degradation.
Action
Instrument business-flow SLIs and establish initial objectives with error-budget review.
Owner
Platform lead
Completion evidence
Weekly review reports successful and ambiguous outcomes for each critical payment stage.
F-04 / AI development practices
The RAG evaluation set does not represent country-specific policy differences, retrieval failures, or human-escalation cases.
Confidence: Medium
Evidence inspected
Current evaluation emphasizes fluent answers from one market and does not score citation support or safe refusal.
Consequence
Expansion can produce confident but incorrect guidance for customers in a new corridor.
Action
Build market-specific regression sets, require supported citations, and measure escalation quality before launch.
Owner
AI product lead
Completion evidence
The release gate passes agreed retrieval, groundedness, refusal, and escalation thresholds for each active market.
F-05 / Security & SOC 2 readiness
Prompt-injection and tool-permission boundaries have not been tested against untrusted support content.
Confidence: Medium
Evidence inspected
The workflow retrieves customer-provided text and internal content without an adversarial test suite or explicit action allowlist.
Consequence
Manipulated context could expose internal instructions or trigger unintended workflow behavior.
Action
Separate trusted instructions from retrieved content, apply least-privilege tool access, and add adversarial regression tests.
Owner
Security owner
Completion evidence
The workflow resists the agreed injection suite and cannot perform actions outside its documented allowlist.
F-06 / Technical diligence
Architecture decisions, owners, risk acceptances, and operating evidence are distributed across tools and individual knowledge.
Confidence: High
Evidence inspected
The assessment required repeated reconciliation of conflicting diagrams, roadmap notes, and incident ownership.
Consequence
Investor, partner, or audit preparation will consume leadership time and expose inconsistent answers.
Action
Create one maintained engineering evidence index with owners and review dates.
Owner
VP Engineering
Completion evidence
A diligence dry run answers the defined architecture, reliability, security, and roadmap questions from current evidence.
90-day plan
Days 0–30
Protect financial invariants and bound the AI workflow.
- Define and test transaction-state and idempotency invariants.
- Classify reconciliation exceptions and assign owners.
- Disable unbounded AI actions and establish a human-escalation path.
Completion evidence
Replay tests, exception aging view, and documented AI allowlist.
Days 31–60
Install evidence for reliability and release decisions.
- Instrument payment-flow SLIs and initial SLOs.
- Create market-specific RAG and adversarial evaluation sets.
- Publish an engineering evidence index with named owners.
Completion evidence
Weekly flow review, evaluation report, and completed diligence dry run.
Days 61–90
Expand deliberately and remove structural friction.
- Launch one corridor behind explicit operational gates.
- Review ownership and dependency load after the controlled launch.
- Sequence platform improvements using observed constraints rather than a rewrite mandate.
Completion evidence
Launch decision record, ownership review, and approved next-quarter roadmap.
Decisions enabled
- Launch one corridor after the critical payment invariant gate passes.
- Treat AI support as a bounded decision-support workflow, not autonomous customer operations.
- Fund reliability and evaluation instrumentation before broad platform modernization.
- Assign one executive owner for expansion readiness and evidence.
Work deliberately deferred
- A broad microservices or platform rewrite
- Multi-corridor simultaneous launch
- Autonomous AI actions affecting accounts or transactions
- A permanent fractional-leadership engagement before the 90-day plan is tested
Boundaries and exclusions
- No legal, regulatory, tax, or accounting conclusion
- No SOC 2 audit opinion or certification
- No penetration test or production write access
- No review of cardholder data or unnecessary customer records
- No guarantee that the illustrative controls are sufficient for another company