Exception Path Design Review (Delivery)

Exception Path Design Review (Delivery)

1. 01

   Map every branch where the workflow can fail before the build starts

   List the failure classes that matter for this client: empty payloads, duplicate records, API rate limits, expired OAuth tokens, and partial writes. Each class gets a named owner and a defined response.

2. 02

   Assign a dollar cost to each failure class so the client can rank them

   A missed invoice sync and a misrouted support ticket rarely carry the same price. Put a range on each (for example, $0 to $50 for a delayed notification versus $2,000+ for a duplicated billing record) and let the client confirm the ranking.

3. 03

   Decide retry versus escalate for each branch and write the rule down

   Transient 429 and 5xx responses get automatic retry with backoff. Business-logic failures (record not found, validation rejected) go straight to a human queue. Document the threshold in the workflow itself, not in a separate wiki.

4. 04

   Build a dead-letter destination the client can actually read

   Route unhandled items into a shared table or channel with the source record ID, timestamp, and error message. A queue only the agency can open turns every exception into a billable ticket.

5. 05

   Test the exception paths with synthetic bad data, not just the happy path

   Push a null email, a 10,000-character field, and a duplicate contact through the live workflow in a sandbox account. Record what the platform did versus what the design said it would do.

6. 06

   Set alerting thresholds and name who receives them

   Agree on the trigger (three consecutive failures, or a queue depth above 25) and the recipient on the client side. Confirm the alert lands in a channel the client checks daily, not an agency inbox.

7. 07

   Cap the blast radius with a kill switch and a documented pause procedure

   Any workflow touching billing, inventory, or client-facing email needs a one-click disable and a written restart checklist. Note the platform limit that constrains this, such as execution quotas or concurrent-run ceilings.

8. 08

   Record the exception inventory in the handoff pack and re-review at 30 days

   The exception list is the maintenance contract. Revisit it after the first month of live volume, because real failure rates rarely match the scoping estimates.