Integration patterns and operational safety
Recommended patterns
Section titled “Recommended patterns”Inventory synchronisation
Section titled “Inventory synchronisation”Use a stable external identifier and reconcile before creating. Treat Gamut’s returned record ID as the governance identity. Send only changed, validated fields and route conflicts to human review.
Evidence ingestion
Section titled “Evidence ingestion”Send metadata, provenance and links needed to assess the claim. Avoid unrestricted data dumps. An uploaded artifact still requires reviewer sufficiency and scope decisions.
Reporting extraction
Section titled “Reporting extraction”Read from a defined workspace and cutoff time. Preserve generation metadata and explain that the extract is point-in-time. Do not combine tenants or silently discard unassessed records.
Event-driven follow-up
Section titled “Event-driven follow-up”Make handlers idempotent. Store the event or request identifier, detect repeats and use bounded backoff for transient failure. Do not retry validation or permission failures as though they were temporary.
Concurrency and reconciliation
Section titled “Concurrency and reconciliation”Before overwriting a record, confirm that it has not materially changed since it was read. Where a supported resource returns version or update metadata, use it to detect conflicts. Prefer a visible conflict requiring review over last-write-wins for governance conclusions.
Production checklist
Section titled “Production checklist”- Dedicated minimum-role integration identity.
- One token per workspace and purpose.
- Expiry, rotation and revocation procedure.
- Input validation and output encoding.
- Timeouts and bounded retries.
- No secrets or tokens in logs.
- Tenant and record identifiers checked on every operation.
- Monitoring for authentication, permission, quota and reconciliation failures.
- Tested recovery and decommissioning procedure.