4E Four eyes on money
Three actions require two different people, enforced by the API with a 403 maker_checker error rather than a greyed-out button:
- A billing cycle is approved by one Finance Officer and checked by a second before bills are issued.
- Account adjustments above US$200 (credit note, debit note, write-off, tariff change, interest freeze) wait in the approval queue for a Finance Officer other than the requester. Smaller ones apply immediately but are still logged.
- A payment reversal is requested by Finance or Support, approved by a different Finance Officer, then executed.
R Reason, then record
Every state change asks for a reason and writes an audit entry with who, what, when and the before/after values. The Auditor, Council Admin and Thinkn Ops read the log; nobody edits it.
Read-only roles are read-only in the API too: an Auditor who somehow reaches a write endpoint gets 403, not a quiet success.
D District scope lives in the API
A District Officer's session carries the assigned district(s). The API filters properties, bills, payments, arrears and tickets to that district's suburbs and rejects anything outside it with 403. Dashboard KPIs are scaled to the district. The interface never has to remember to filter.
P Property ownership for residents
Every resident call checks that the property is linked to the signed-in resident. Tenants are further scoped to the services the owner shared (typically water and refuse) and to the expiry the owner set. Pending residents can see bills and pay, but cannot edit their name or phone until Support verifies the registration.