Inventory the systems
List every application, database, file store, queue, identity provider, spreadsheet, and manual step involved in the workflow. For each, record its business owner, technical owner, access method, environment, and change constraints.
Which system is authoritative for each important entity and field?
Is access available through an API, event, export, database, or manual action?
What rate limits, maintenance windows, licensing, or vendor constraints apply?
Who approves schema, permission, workflow, and production changes?
Map the data flow
Trace data from trigger to final state. Name the direction, timing, transformation, identifier, and expected result at every handoff.
| Decision | Questions | Risk if unclear |
|---|---|---|
| Direction | One-way, two-way, request/response, or event-driven? | Loops, overwrites, and conflicting updates |
| Identity | Which key connects the same record across systems? | Duplicates and incorrect joins |
| Timing | Immediate, scheduled, or eventually consistent? | Users act on stale or partial information |
| Transformation | How are types, statuses, units, and business rules mapped? | Silent semantic errors |
Define trust boundaries
Document where data crosses organizations, networks, regions, vendors, and privilege levels. Minimize what moves and ensure credentials are scoped, rotated, monitored, and owned.
- Data classification and fields that must be excluded, masked, or encrypted.
- Service identities, user delegation, roles, and least-privilege permissions.
- Secrets storage, rotation, expiry, and emergency revocation.
- Audit requirements, retention, residency, and third-party obligations.
Design for failure
Every integration eventually encounters unavailable services, invalid data, duplicate events, timeouts, partial success, and breaking changes. Decide what the system and the operator should do in each case.
Detect
Logs, metrics, traces, reconciliation, and alerts make invisible failures observable.
Contain
Validation, idempotency, retries, queues, circuit breakers, and dead-letter handling limit damage.
Recover
Replay, reconciliation, manual correction, rollback, and escalation restore a known state.
Assign operational ownership
A technically successful integration can still fail operationally when nobody owns monitoring, vendor changes, access renewal, data reconciliation, or incident response.
Complete the handoff before launch.
- Business and technical owners are named for every system.
- Source-of-truth and conflict rules are documented.
- Dashboards, alerts, and escalation routes are live.
- Retry, replay, reconciliation, and correction steps are tested.
- Credential rotation and vendor-change review have owners.
- A runbook explains common failure and recovery paths.