System design
One product deployment, four external boundaries
The browser never talks directly to the ledger, Redis, or email provider. Next.js server code validates sessions and coordinates every external operation.
Rendering diagram...
Authority by concern
| Concern | Authority |
|---|---|
| Whether payroll settled | Canton ledger state |
| Who can read a pay record | Daml stakeholders |
| Web access | Signed role-scoped session |
| OTP use and rate limits | Redis atomic state |
| Email delivery status | Provider response plus Redis operational state |
Where authority lives
Hosting only runs the product interface and server integration code. It does not decide payroll settlement. Settlement authority lives in the Canton command that consumes the current PayrollState, validates live profile and audit-grant contracts, and creates the run and private receipts atomically. Redis can show an in-progress state, but it cannot settle, duplicate, or authorize payroll.