Engineering — Change Request Flow

// A change-request pipeline through a service estate: requests raised
// against the services below, reviewed, approved, deployed. Every request
// that did not reach production is attributed to the gate that stopped
// it, so the approval rate and the estate it applies to are one document.

system billing_estate {
  title: "Billing estate"
  owner: "Payments platform"
}

actor service_engineer {
  title: "Service engineer"
  kind: "user"
  depends: [gateway, ledger, invoicing, reporting]
}

actor change_board {
  title: "Change advisory board"
  kind: "user"
  depends: [audit_log]
}

service gateway {
  title: "Payment gateway"
  runtime: "Go"
  tier: "edge"
}

service ledger {
  title: "Ledger service"
  runtime: "Rust"
  depends: [gateway]
  tier: "core"
}

service invoicing {
  title: "Invoicing"
  runtime: "TypeScript on Node"
  depends: [ledger]
  tier: "core"
}

service reporting {
  title: "Finance reporting"
  runtime: "Python"
  depends: [ledger]
  tier: "batch"
}

datastore ledger_db {
  kind: "postgres"
  title: "Ledger of record"
}

datastore audit_log {
  kind: "s3"
  title: "Immutable change audit log"
}

// ── The change pipeline. 642 raised, 441 in production without a
//    rollback, and every request that stopped has a gate against it.
cohort requests_raised {
  n: 642 source "Change register, FY26 Q1"
}

cohort accepted_for_review {
  n: 588
  from: requests_raised
  excluded: {
    duplicate_request: 33
    withdrawn_by_requester: 21
  }
}

cohort risk_assessed {
  n: 541
  from: accepted_for_review
  excluded: {
    returned_for_missing_rollback_plan: 34
    returned_for_missing_test_evidence: 13
  }
}

cohort approved {
  n: 468
  from: risk_assessed
  excluded: {
    rejected_by_change_board: 52
    deferred_to_next_window: 21
  }
}

cohort deployed {
  n: 449
  from: approved
  excluded: {
    change_window_missed: 12
    blocked_by_release_freeze: 7
  }
}

cohort stable_after_deploy {
  n: 441
  from: deployed
  excluded: {
    rolled_back_within_24_hours: 6
    emergency_fix_required: 2
  }
}

view containers: c4_container(billing_estate)
view changes: consort(requests_raised)