Keep each Xero request tied to the intended organisation
Concurrent jobs must not share mutable tenant context. Resolve and pass the connection explicitly so one organisation's work cannot be sent under another's identity.
Read articleCobnex blogs / Global
Cobnex blog
AI implementation, software architecture and cloud operations for teams worldwide.
456 articles
Page 18 of 26
Sync only the CRM fields the receiving service needs
A contact record can contain more information than an operational workflow requires. Limit both transport and destination access to the purpose of the integration.
Read articleVerify the signature before trusting the webhook payload
A public endpoint must establish who sent the request and which account it concerns. Valid JSON and a familiar event name provide neither assurance.
Read articleResolve rate-limit scope from trusted identity
A client-supplied account label must not choose an unrestricted budget or another tenant's queue. Keep scheduling scope tied to the authorised integration connection.
Read articleDead-letter access can expose failed customer payloads
Failed messages often retain the original request and diagnostic detail. Restrict inspection and replay according to the data and effects involved.
Read articleAsk for less, and protect what the form does collect
Form accessibility and data handling meet in the same workflow. Clear questions, scoped drafts and safe error messages reduce both confusion and unnecessary exposure.
Read articleHiding a table column does not restrict its data
Review the server response, exports and row actions as well as visible columns. Responsive presentation is not an authorisation boundary.
Read articleA recovered draft still needs current permission
Reauthentication proves an identity now. It does not automatically authorise an old action or transfer a previous user's saved work.
Read articleSearch relevance must be judged inside the user's permission boundary
Private documents should never compete for visibility with public results. Evaluate ranking only after the access model defines what the user may receive.
Read articleBuild dependencies inherit the build job's reach
Review credentials and network access where third-party code executes. A package excluded from production can still affect the software you deploy.
Read articleReview who can assume the role, not only what it can read
Trust policy and effective resource access form one boundary. Either side can expose data if reviewed in isolation.
Read articleKeep incident notes useful without copying secrets into them
Responders need evidence quickly, but the working record should not become a second store of credentials or unrestricted customer data.
Read articleA retention hold needs authority, scope and a release path
Exceptions can preserve necessary records, but an unowned hold can quietly suspend deletion forever. Treat creation and removal as controlled decisions.
Read articleThe hidden cost of permission-specific caches
Caching can reduce search and model costs, but protected answers cannot be shared just because the question text matches. Model the access boundary before choosing the cache key.
Read articleDoes the reranker earn its latency?
A second ranking stage should improve the passages people use. Measure its contribution separately from the cost of retrieving more candidates.
Read articleHow much neighbouring context is enough?
Adding nearby text can repair an incomplete passage, but it can also add duplication and conflicting material. Measure the information gained rather than choosing the largest context window available.
Read articleThe review cost of claim-level evidence
Citation checking adds retrieval, evaluation and human review work. Spend that effort where an unsupported claim would change a decision.
Read articleRefresh urgent policies more often than reference material
One refresh schedule rarely suits an entire knowledge base. Spend processing capacity according to how often information changes and what a stale answer would cost.
Read article