Architectural Principles

Status: FROZEN — Foundation v1.0

1. Tenant isolation before convenience. Tenant context is resolved and authorized server-side; client-provided tenant IDs are never sufficient authorization.
2. Tenant ≠ vertical. Organizations compose business capability through Business Units.
3. One primary vertical per Business Unit. Each Business Unit has exactly one platform-governed Primary Vertical Preset; compatible additional capabilities are entitlement- and billing-aware.
4. Configuration before forks. New verticals should prefer schemas, capability packs and workflow presets over tenant-specific code.
5. Strong transaction core, flexible edges. Orders, payments, bookings, availability and identity are strongly modeled; vertical attributes are schema-driven.
6. One backend platform. Managed and Custom sites use the same authoritative business platform; Custom does not imply a backend fork.
7. Managed vs Custom is contractual. Headless/hybrid access exists only for the Custom plan.
8. API-first boundaries. Public/admin/headless consumers use versioned contracts.
9. Events for propagation, not hidden coupling. Cross-engine side effects use explicit events where asynchronous behavior is appropriate; concrete event infrastructure is a technology decision.
10. Idempotency for money/reservations. Mutating booking/payment/integration operations must define replay behavior.
11. Audit meaningful mutation. Plan, entitlement, access, price, availability, booking, payment, publication and integration changes are attributable.
12. Avoid premature distribution. Service extraction must be justified by scale, ownership, reliability or deployment requirements; Foundation v1.0 does not select the implementation topology.
13. Legacy parity is explicit. Migration cannot drop behavior by omission.
14. Locale-aware from the start. Internationalization is not a Site-only feature; every engine/API is locale-aware, while locale, currency, timezone and market remain independent.
15. Customer identity is tenant-wide. Business Units share a tenant customer identity model; staff visibility can remain Business-Unit scoped.
16. Commercial aggregates may span Business Units, never Tenants. Orders may contain lines from multiple Business Units of one Tenant.
17. External money/accounts remain tenant-owned by default. Tenant customer payments and advertising spend use tenant-connected provider accounts; Touriffique does not assume custody or merchant-of-record status.
18. Capability expansion is commercially explicit. Enabling additional compatible capabilities may change subscription billing and must pass entitlement/commercial validation.