---
id: ADR-PFM-INT-001
title: 'Three source modules, one owner per record'
product_area: platform
module: integrations
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Keep separate service ownership for integration records, customization configuration and workflow
  configuration. Business records and workflow runtime history belong to hosts; restricted host roles may also
  write extension invocation history.
constrains:
  - DOM-PFM-INT-001
  - DOM-PFM-INT-002
  - DOM-PFM-INT-003
  - DOM-PFM-INT-004
  - DOM-PFM-INT-005
  - DOM-PFM-INT-006
  - SVC-PFM-INT-integrations
  - SVC-PFM-INT-extensions
  - SVC-PFM-INT-workflow-actions
  - RESP-PFM
alternatives:
  - option: Combine the three configuration services.
    why_not: 'Combining existing route, persistence and registration boundaries would make accountability less clear.'
  - option: Replicate provider and customization configuration in each application.
    why_not: 'Each application would then need its own secret, routing and admission safeguards.'
consequences:
  - An owning service remains responsible for its object even when a restricted host writer is permitted.
  - >-
    Hosts load shared workflow configuration; provider requests use the integration gateway and outcome
    boundaries.
  - 'Consumers interpret their own business effects, including payment meaning.'
origin: >-
  docs/proposals/application-processes-and-workflow-actions/14-decisions.md D-03 (Andrew 2026-10-17);
  docs/proposals/extensibility/decision-log.md A4, A7
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a65: modules/integrations, modules/extensions, modules/workflow-actions (db,
    services/persistence); docs/persistence.md
---

# Three source modules, one owner per record

## Context

The wider ownership synthesis remains proposed because the cited workflow decision alone does not approve all three service boundaries.

## Decision

Keep separate service ownership for integration records, customization configuration and workflow configuration. Business records and workflow runtime history belong to hosts; restricted host roles may also write extension invocation history.

## Alternatives Considered

Combine the three configuration services. Combining existing route, persistence and registration boundaries would make accountability less clear.

Replicate provider and customization configuration in each application. Each application would then need its own secret, routing and admission safeguards.

## Consequences

An owning service remains responsible for its object even when a restricted host writer is permitted.

Hosts load shared workflow configuration; provider requests use the integration gateway and outcome boundaries.

Consumers interpret their own business effects, including payment meaning.