Technical decisions, written down by the engineers

We accept the trouble. In a multi-tenant system, “a bit of extra work” and “a data leak” are not problems of the same magnitude.

What these costs buy is this: for every data access an agent makes, you can answer “who authorized it, which tool was used, which permissions were exercised”. In compliance-driven settings, that ability to answer is the price of admission.

An architecture decision is, at bottom, a comparison of costs — not a pursuit of whatever shape is “more advanced”. If single-domain throughput ever truly becomes the bottleneck, splitting that domain back out amounts to copying the api contract once.

We push the parts AI speeds up as far as they will go — but the question of who answers for the result is not something we hand to the model.

We traded a model that is more awkward to write for the elimination of an entire class of “the balance does not add up” problems. For a bookkeeping tool, that is a very good trade.

Cross-platform behavioural drift is the kind of defect that is hard to trace once it bites and persists forever if you never trace it. Eliminating it before it happens with build-time constraints is far cheaper than reconciling afterwards.