Decision, constraint and consequence—without hiding the trade-off.
Only ADRs appropriate for public explanation appear here. Credentials, sensitive topology and exploitable defensive detail stay private.
Tenant isolation through explicit scoped access
Use a shared schema with tenant_id on business data and enforce tenant scope through the data-access boundary; PostgreSQL RLS remains a documented future defense-in-depth option.
Entitlements are materialized as immutable snapshots
Effective rights are reproduced from append-only snapshots and time-bounded overrides, not live mutable catalog joins.
Fox Pay uses a Bring Your Own Merchant model
Merchant accounts and provider credentials belong to the customer; Fox Pay orchestrates integrations without becoming a PSP, custodian or settlement intermediary.
Provider-specific payment behavior stays behind adapters
Core depends on normalized capabilities rather than importing provider implementations directly.
Bidirectional UI is a core SFAS contract
RTL and LTR have equal release weight; direction comes from locale and shared CSS defaults to logical edges.