The switch that must be instant and must not be readable
A decision of this kind is made dozens of times inside a single request — which plan, which experiment, which rollout — so it cannot cost a network call. Changing one must take effect everywhere within seconds without a deploy. And the rules encode commercial logic and reference personal attributes, so nobody who unpacks the mobile app may be able to read them.
The web and mobile apps need these decisions too. That last sentence is what makes this hard: the same data has to travel two different ways, and the reason is security rather than performance.
- R1Exactly one component inside the network may hold the outbound connection to the external service that publishes the rules, and it distributes them onward to every process. Application instances must not each open their own, and nothing outside may open one inward.
- R2A process that STARTS while the external service is unreachable must still come up with usable values. Continuing to run with what you already have is easy; starting from nothing during an outage is what this requirement is about, so the last known ruleset must survive a restart.
- R3Browsers and mobile apps get the RESULT of a decision for their own context and never the rules themselves. Whatever serves them evaluates per request and hands back an answer; it must not be a second thing distributing the ruleset.
Boundaries, outermost first: OUR NETWORK: App instance (evaluates in memory), Impressions (off the decision path), an empty slot for the the one connection out, shared inward, tier 1, an empty slot for the what a starting process reads, tier 1 Outside every boundary: Rule authoring (outside, a vendor), Browser and mobile (untrusted), an empty slot for the answers, never rules, tier 2 Connections: the one connection out, shared inward sends outbound traffic to Rule authoring — one connection, outward the one connection out, shared inward controls App instance — ruleset push the one connection out, shared inward calls what a starting process reads App instance calls what a starting process reads — cold start Browser and mobile calls answers, never rules — one answer App instance publishes to Impressions