A retailer's returns agent can submit a refund of any amount, and no person sees the refund before the money is paid. What control should the architect put on that tool?
Select an answer to reveal the explanation.
Short Explanation
A cash drawer with no lock does not become safe because you wrote be careful on the lid. You cap the refund tool and require approval before any refund above that cap is paid. A satisfaction score after the money has left tells you the damage later.
Full Explanation
A refund is a consequential action, so the tool that pays it needs a limit and a person when the amount crosses that limit. The returns agent can refund any amount with no one looking, and the control is a cap on the tool plus approval before a refund above the cap is paid. The tool is what moves the money, so the control has to sit on the tool, at the amount, before the payment is sent. A longer system prompt that urges the agent to be careful is wording, and wording does not stop the tool from paying an uncapped amount. A shopper satisfaction score collected after the refund has already been paid is a trailing signal, not a gate on the payment. A second returns agent that calls the same uncapped tool under a different display name duplicates the hole instead of closing it. Exam caveat: amounts under the cap can still be paid by the agent; the approval is the boundary, not a requirement that a person touch every refund. Operational check: submit one refund under the cap and confirm it proceeds, then submit one over the cap and confirm payment waits until the approval is recorded.