---
id: WF-COM-CAT-001
title: Save a checkout policy against Accounting's references
trigger: >-
  Staff save a reusable checkout policy after checking its financial context. Most refusals leave the prior
  policy intact, but an Accounting connection failure permits an unchecked merchant-account reference.
product_area: commerce
module: catalog
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
implements:
  - CAP-COM-CAT-001
  - CAP-COM-CAT-002
moves:
  - STATE-COM-CAT-001
crosses:
  - SVC-COM-CAT-configuration
idempotency: >-
  Creation can use an optional request key. Successful replacement advances the version, so repeating the old
  version is rejected; duplicate creation without replay protection conflicts on identity.
concurrency: >-
  Policy locking and version comparison reject racing stale edits. Default transfer is atomic, and the partial
  unique index prevents duplicate workspace designations.
hops:
  - 'n': 1
    actor_or_service: Console or API caller
    action: 'Submit the full policy and, for replacement, its read version.'
    anchor: 'services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts'
    seam: sync
    on_failure: 'Reject malformed input, blank or repeated tender values and reserved keys with field-specific feedback.'
    left_inconsistent: No configuration change is retained.
    observer: The requesting person or service receives the result and any returned refusal.
    provenance: test
    source: >-
      services-commerce:modules/configuration/tests/unit/api/blank-ordering-profile-ids.spec.js#refuses a
      blank entry beside a good one on a create, naming the entry
  - 'n': 2
    actor_or_service: Configuration service
    action: Read Accounting’s unit currencies and validate the policy currency.
    anchor: 'services-commerce:modules/configuration/services/persistence/ordering-profiles.ts'
    seam: sync
    on_failure: Reject unsupported currency without replacing the policy.
    left_inconsistent: The previous policy remains saved.
    observer: The requesting person or service receives the result and any returned refusal.
    provenance: test
    source: >-
      services-commerce:modules/configuration/tests/e2e/ordering-profiles.e2e.spec.js#answers 400
      currency_not_supported_by_business_unit to a currency the business unit does not transact in
  - 'n': 3
    actor_or_service: Configuration service to Accounting
    action: Ask Accounting whether the default merchant account is active and matches the unit and currency.
    anchor: 'services-commerce:modules/configuration/services/persistence/ordering-profiles.ts'
    seam: sync
    on_failure: >-
      Reject unknown or mismatched accounts; log connectivity failure and permit the save without
      verification.
    left_inconsistent: Connectivity failure can leave a saved account reference that was not verified.
    observer: Request feedback and service logs expose failures where the caller returns them.
    provenance: test
    source: >-
      services-commerce:modules/configuration/tests/unit/persistence/ordering-profile-merchant-account.spec.js#is
      let through, logged, when Accounting is unreachable
  - 'n': 4
    actor_or_service: Configuration service
    action: >-
      Lock and version-check the policy, apply protection and default checks, then commit the record and any
      workspace-default transfer.
    anchor: 'services-commerce:modules/configuration/services/persistence/ordering-profiles.ts'
    seam: sync
    on_failure: 'Roll back on protection, version or default-policy refusal and return the reason.'
    left_inconsistent: The policy transaction retains no partial changes.
    observer: The requesting person or service receives the result and any returned refusal.
    provenance: test
    source: >-
      services-commerce:modules/configuration/tests/e2e/ordering-profiles.e2e.spec.js#answers 409 to a stale
      version
branches:
  - >-
    Defaults are saved by another atomic replacement that changes application selections and the workspace
    designation together. Invalid references leave the earlier document intact.
waits: []
evidence:
  - >-
    services-commerce at c8b66a98: modules/configuration/services/persistence/ordering-profiles.ts;
    aws/api/ordering-profiles.routes.ts; tests/unit/persistence/ordering-profile-merchant-account.spec.js;
    tests/e2e/ordering-profiles.e2e.spec.js.
  - 'react-console at baf6dae3: lib/commerce/ordering-profiles/live.ts (create, replace, defaults document).'
controls: [TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-CRY-001, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-002, TC-PI-003, TC-PRV-001, TC-PRV-002]
---

# Save a checkout policy against Accounting's references

## What It Does

Staff save a reusable checkout policy after checking its financial context. Most refusals leave the prior policy intact, but an Accounting connection failure permits an unchecked merchant-account reference.

## The Flow

```mermaid
sequenceDiagram
  participant S as Staff (console)
  participant C as Configuration service
  participant A as Accounting
  participant D as Commerce database
  S->>C: create or replace policy (version read)
  C->>A: business unit currencies
  A-->>C: supported currencies
  C->>A: merchant account
  alt Accounting unreachable
    C-->>C: log a warning, continue
  else account wrong
    C-->>S: refused, naming the account
  end
  C->>D: lock row, check version, defaults, write
  D-->>C: committed
  C-->>S: saved policy
```

## When Something Fails

Reject malformed input, blank or repeated tender values and reserved keys with field-specific feedback. No configuration change is retained. Reject unsupported currency without replacing the policy. The previous policy remains saved. Reject unknown or mismatched accounts; log connectivity failure and permit the save without verification. Connectivity failure can leave a saved account reference that was not verified. Roll back on protection, version or default-policy refusal and return the reason. The policy transaction retains no partial changes.

## Open Design Questions

The implemented recovery and concurrency behaviour above defines the current boundary. Any change to transaction scope or product authority requires a recorded decision.