Requirements

Functional

Write Constraints

• No negative balance — insufficient funds must be rejected
• Multiple updates must be atomic
• Idempotency — the same order must not update balance twice
• Each update must generate a corresponding ledger record
• Only authorized internal services are allowed to perform write operations

Read Constraints

• Query balance must not lag too far behind

System Requirements

• Must ensure data eventual consistency across service boundaries

Non-Functional

Scale

• 10M–100M total users
• DAU 100k–500k

Throughput & Latency

• Read/write P95 latency < 50ms
• Average: 100k balance updates/sec
• Peak: 1 million updates/sec