Retire the admin panel’s open write access. Keep the intervention.
Your admin panel can write to anything, and logs which row changed rather than which decision. Separate reading a case from acting on it.
The systems you already run, the objects your product declares, and the work your team gets back.
These marks name the kinds of system a source declaration reaches — a picture of the ecosystem, not a fixed menu, and nothing here implies a partnership.
Read the whole case. Write almost nothing.
Both sides on one record
Seller, buyer, listing, order, payout and dispute become one typed record, not three dashboards stitched together by hand.
Who refunded this, and why
A refund becomes an Action with declared effects and a recorded reason, so the ledger answers both questions.
Onboard without widening access
A new reviewer reads every case on day one and can still change only what you declared.
What teams build. On day one.
Four places this work turns into declared objects, governed reads, and reviewed changes.
Dispute case
One Function assembles the whole case — account, listings, order history, prior reports, payment signals, past decisions — each traceable to its source.
Suspension and reinstatement
Suspending a seller is an Action with declared effects on listings, payouts and open orders; the appeal six weeks later reads the decision.
Refund exceptions
A goodwill refund over your limit reaches the buyer only after a second person has seen the exact amount and account.
Bulk moderation
Delisting a seller’s whole catalogue is one Action over many objects, recorded once, with every listing it touched named in the plan.
How it runs. End to end.
The same path every product takes: connect what exists, declare what it means, then publish the reads and the changes.
- 01
Capture the systems the marketplace runs on
Your application database, payments provider and support desk stay where they are. Bijection gets a read credential and nothing more, and copies on whatever interval you pick. It is a copy, not a live feed: every case carries the pull behind it, so a reviewer sees how old a payout state is before acting on it.
- 02
Declare both sides and what connects them
Seller, listing, buyer, order, payout, dispute and the links between them, written once in reviewed product source. Rentals or freight, the kernel is the same; only the declaration differs.
- 03
Turn each intervention into an Action
Everything the admin panel does today becomes an Action with typed inputs, declared effects and a review rule. The panel stays; its direct line to the database does not.
- 04
Put agents on the queue under the same rules
An agent works the backlog through the same Functions a reviewer reads, and can propose only the Actions that reviewer could already take. Anything you marked for review still waits for a person.
Common questions.
It does the work. The question is what else it can do: a panel with broad write access records the row that changed, not the policy someone applied. Keep the interface your team knows and have it call declared Actions, so the reach of the tool becomes the list of Actions you wrote down.
We publish no throughput figures, and you should not take one on trust from any vendor. Reads are governed Functions over captured sources and interventions are Actions, so capacity is a property of your own deployment. Run your real queue shape in your own environment before you commit.
A scheduled capture is not a live read, and a case says which capture it used rather than implying a freshness it does not have. Where a decision has to reflect the current world, the Action plans against what it depends on and refuses to execute if that moved between the plan and the approval.
Bring us a process.
We'll build it with you.
A business process, the systems it touches, and the rules it needs to follow.