Handling Cross-Cutting Concerns
1. Implementing Request Correlation
| Element | Detail |
|---|---|
| Trace context | W3C traceparent in every hop |
| Request ID | Per HTTP request UUID |
| Workflow ID | For long sagas |
2. Managing Service Identity
| Mechanism | Detail |
|---|---|
| SPIFFE / SPIRE | Workload identity (SVID) |
| K8s ServiceAccount | Per service |
| mTLS cert | Bound to identity (mesh) |
3. Implementing Tenant Isolation
| Model | Detail |
|---|---|
| Silo | Per-tenant infra (strongest) |
| Pool | Shared infra; tenantId in code (cheapest) |
| Bridge | Hybrid (e.g. silo DB, pool app) |
| Enforcement | Row-level security; OPA checks |
4. Handling Internationalization
| Element | Detail |
|---|---|
| Locale | From Accept-Language |
| Catalogs | ICU MessageFormat |
| Server vs client | Server for emails / PDFs |
| Pluralization | CLDR rules |
5. Implementing Audit Logging
| Field | Detail |
|---|---|
| who | userId / serviceAccount |
| what | action + resource |
| when | UTC timestamp |
| where | IP, region |
| change | before/after diff |
| store | Append-only / WORM |
6. Managing Data Privacy
| Practice | Detail |
|---|---|
| Data classification | Public / internal / confidential / PII |
| Minimization | Collect only what's needed |
| DSAR | Export / delete on request |
| Encryption | At rest + in transit |
7. Implementing Compliance Controls
| Standard | Detail |
|---|---|
| SOC 2 / ISO 27001 | Security controls |
| GDPR / CCPA | Privacy |
| PCI-DSS | Cards |
| HIPAA | Health |
| Evidence | Automate via Drata, Vanta |
8. Handling Time Zones
| Rule | Detail |
|---|---|
| Store UTC | Always |
| Display local | Convert at boundary |
| IANA TZ | America/New_York not EST |
| DST | Use library; don't compute offsets |
9. Implementing Accessibility
| Element | Detail |
|---|---|
| WCAG 2.2 | AA target |
| API | Localized error messages |
| Email/PDF | Tagged PDF, alt text |
10. Managing Environmental Configuration
| Aspect | Detail |
|---|---|
| Env-specific files | dev / stage / prod |
| Promotion | Same artifact, different config |
| Drift detection | GitOps reconcile |
11. Implementing Feature Flags
| Practice | Detail |
|---|---|
| Per-tenant / per-user | Targeting rules |
| Default safe | Off-by-default for risky flags |
| Cleanup | Schedule flag removal |
| OpenFeature | Vendor-neutral SDK |
12. Managing Cross-Service Transactions
| Pattern | Detail |
|---|---|
| Saga | Local TX + compensations |
| Outbox | Atomic write + publish |
| Idempotency keys | Safe retries |
| Avoid 2PC | Across services |