---
id: ADR-PFM-INT-003
title: Bindings choose the account; money never falls back
product_area: platform
module: integrations
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Select the provider account through scoped bindings, checking the most specific scope first. Sensitive
  capabilities and refusal policies stop at an ineligible choice; a provider circuit does not redirect a call
  to another account.
constrains:
  - DOM-PFM-INT-003
  - STATE-PFM-INT-006
  - STATE-PFM-INT-008
  - WF-PFM-INT-009
  - WF-PFM-INT-011
  - SCR-PFM-INT-008
  - SVC-PFM-INT-integrations
alternatives:
  - option: Require an explicitly selected account for every application call.
    why_not: >-
      Applications would duplicate routing configuration; explicit account selection is still needed for
      operations tied to an earlier provider action.
  - option: Choose another provider when the selected account refuses.
    why_not: Financial work could reach an account or processor the caller did not intend.
consequences:
  - A sensitive operation returns the refusal instead of switching processors.
  - Explanation exposes binding selection and eligibility rather than making provider work.
  - Changes to account or installation usability reassess dependent bindings.
origin: >-
  docs/milestones/INTG-M2-calls-through-the-gateway.md#Decisions M2-D4 (Andrew);
  docs/integrations/README.md#The pipeline (13 §5) (Andrew 2026-10-19 decision 2)
supersedes: []
---

# Bindings choose the account; money never falls back

## Context

Financial routing must preserve the intended processor across refusals.

## Decision

Select the provider account through scoped bindings, checking the most specific scope first. Sensitive capabilities and refusal policies stop at an ineligible choice; a provider circuit does not redirect a call to another account.

## Alternatives Considered

Require an explicitly selected account for every application call. Applications would duplicate routing configuration; explicit account selection is still needed for operations tied to an earlier provider action.

Choose another provider when the selected account refuses. Financial work could reach an account or processor the caller did not intend.

## Consequences

A sensitive operation returns the refusal instead of switching processors.

Explanation exposes binding selection and eligibility rather than making provider work.

Changes to account or installation usability reassess dependent bindings.