A billing app silently overwrites mastered address attributes with local edits. What consumption rule should governance enforce?

A billing app that silently overwrites mastered address attributes with local edits violates a core consumption rule: consuming systems must not overwrite mastered attributes outside a governed change process. Golden masters lose trust when every screen becomes an unauthorized system of record. Allowing any local screen to become the new system of record without notice fails MDM consumption discipline. Banning all read access to masters so apps invent their own addresses fails the point of publishing masters. Requiring consumers to delete masters after each successful print job is nonsensical and destructive. Exam caveat: consumers subscribe to masters; they do not silently clobber mastered attributes. Operational check: enforce read-only mastered fields in billing UI or route edits through MDM change requests, detect overwrite attempts in logs, and remediate drift. Add the consumption rule to municipal integration standards and verify in code review. Keep verification evidence with the municipal runbook so audits can prove the chosen control was applied as designed and that rejected alternatives would have left city services exposed to the failure modes described above. Keep verification evidence with the municipal runbook so audits can prove the chosen control was applied as designed and that rejected alternatives would have left city services exposed to the failure modes described above.