Plain-English definitions.

Active-active gives you near-zero RTO at the cost of harder data consistency and roughly double the infra bill. For most African fintechs, active-passive with warm standby is a better starting point — active-active only pays off once you have provable cross-region latency requirements and the operational maturity to run two live data planes.

ADRs prevent the "why did we do this?" tax that hits every engineering team eighteen months in. We keep ours in the repo alongside the code so the decision lives with the system it shaped. Tooling is irrelevant — the discipline of writing one before you merge is what matters.

For software companies, AfCFTA matters because it normalises cross-border digital services, payments, and data flows across 54 signatory countries. The hard part isn't the treaty; it's reconciling 54 different data-protection, tax, and licensing regimes underneath it. We build systems with that fragmentation baked in.

For digital products, rules of origin are still being negotiated, but for physical goods moved by our logistics clients they're a daily reality. We've built customs-classification engines that auto-derive origin status from BOM data so finance teams stop guessing at the border.

Integrating Airtel Money still means handling per-country quirks — Uganda's callback model differs from Zambia's, and DRC has its own auth dance. Our payments orchestration layer normalises all of this behind a single idempotent interface so product teams stop writing per-country branches.

In practice, AML for African fintechs means transaction monitoring rules, sanctions screening, suspicious activity reporting to your FIU, and a Money Laundering Reporting Officer who answers to the regulator. Buying a vendor tool is the easy part; tuning it so analysts aren't drowning in false positives is the multi-quarter job.

Gateways earn their keep when you have more than one consumer and more than one backend — before that, they're a load-bearing YAML file pretending to be infrastructure. We prefer Kong, Envoy, or AWS API Gateway depending on the constraints, and we keep the gateway dumb: heavy logic belongs in services, not config.

Argo CD turns "what's running in prod?" into a query against Git rather than a phone call to the on-call engineer. We deploy it for clients who've outgrown imperative kubectl scripts but still want one obvious answer to "who changed what, when?"

If you can't answer "who approved this transaction at 02:13 from which IP?" in under 60 seconds, your audit log is a liability dressed as a feature. We design ours to be tamper-evident, queryable, and exported nightly to immutable storage so regulators see the same data your engineers do.

af-south-1 is the right default for data-residency-sensitive African workloads but does not have every AWS service GA — check the regional services list before you architect. For West African latency, we still pair Cape Town with eu-west-3 (Paris) and treat North African traffic through eu-south-1.

BFFs eliminate the over-fetching and under-fetching tax of a one-size-fits-all API. The trap is letting them grow into a business-logic dumping ground — keep the BFF responsible for aggregation and shaping, push rules into domain services.

BIAN is most useful as a shared vocabulary between business and engineering during a core-banking transformation. It is not a product, and treating its service domains as a literal microservice catalogue produces a Frankenstein system. Use it to map capabilities, then design services to your actual load.

Blue-green gives you instant rollback and a clean "before" environment for verification. The cost is doubled infra during the swap and harder data-migration choreography — for most stateful systems we now prefer canary releases with feature flags.

BoG's Payment Systems and Services Act (Act 987) governs anyone touching money flows in Ghana, with separate licence categories for DEMI, EMI, PSP, and Payment Solution Service Providers. We help clients structure tech stacks that map cleanly to BoG's reporting templates so audits stop being heroic exercises.

Bounded contexts are why "Customer" in your billing service can legitimately mean something different from "Customer" in your support service, without anyone lying. Getting these boundaries right is the single highest-leverage architecture decision you make.

A bus factor of 1 isn't a risk; it's a guarantee of pain. We audit ours quarterly through pairing rotations, written runbooks, and deliberate "X is on holiday for two weeks" drills so the heroics are designed out before the crisis.

Canaries beat blue-green when you have real-time signals (error rate, p99 latency, business KPIs) and the discipline to abort automatically when they degrade. Without those, a canary is just a slower blue-green with the same risk.

CBK's National Payments Strategy 2022-2025 pushes interoperability and ISO 20022 adoption. If you're building in Kenya, plan your message schemas to that standard from day one — retrofitting it later costs roughly 3x what doing it right costs.

CBN's licensing categories (PSSP, MMO, PTSP, Switching) determine what code you can ship and which audits you'll face. Its open-banking guidelines are some of the most prescriptive on the continent — treat them as engineering requirements, not legal afterthoughts.

CDC via Debezium + Kafka beats nightly batch ETL for any system that needs sub-minute analytics or event-driven integration. The catch: schema changes upstream now affect every downstream consumer, so contract testing and schema registry hygiene become non-negotiable.

Chaos engineering is wasted on systems that haven't earned it — fix your basic monitoring and runbooks first. Once you have those, scheduled game-days running tools like Litmus or Gremlin convert nervous "we think it will fail over" into evidence-backed "it did fail over in 47 seconds last Tuesday."

Circuit breakers prevent retry storms and cascading outages, but they're useless without sensible fallback behaviour — "return cached value" or "degrade to read-only" have to be designed deliberately. Resilience4j and Polly are our usual picks.

CMKs are essential when regulators (BoG, NDPC, NDPR) need evidence that even the cloud provider can't decrypt your data without your involvement. The operational cost is real — key rotation, access policies, and break-glass procedures all become your problem.

Cold starts are why "serverless is always cheaper" is wrong for latency-sensitive paths. Provisioned concurrency, smaller deployment packages, and SnapStart-style snapshots help — but if you need sub-100ms p99 on every request, a long-running service is still the honest answer.

CQRS pays off when your read and write loads have wildly different shapes (e.g. a transaction ledger with heavy analytical reads). It carries real complexity tax — eventual consistency, separate stores, sync plumbing — so don't reach for it just because a conference talk made it sound elegant.

DAST catches the runtime-only issues SAST can't — auth bypass, misconfigured headers, business-logic flaws. Tools like ZAP and Burp are the workhorses; the value is in maintaining an authenticated, realistic test surface that DAST can crawl.

dbt turns analytics from a spreadsheet sport into actual engineering, but it's not magic — bad data modelling in SQL is still bad data modelling. We use it as the T in ELT, paired with Snowflake, BigQuery, or DuckDB depending on scale and budget.

DDD's strategic patterns (bounded contexts, context maps, ubiquitous language) are far more valuable than its tactical patterns (aggregates, entities, value objects), which often get cargo-culted. We use the strategic toolkit on every complex domain and pull in tactical patterns only where they earn their cost.

DDoS protection is now table stakes (Cloudflare, AWS Shield, Akamai), but layer-7 attacks targeting expensive endpoints (search, checkout) still get through volumetric filters. We pair edge protection with WAF rules, aggressive rate limiting, and circuit breakers on the costly paths.

Silent removal is not deprecation; it's breaking change theatre. Real deprecation policies have a minimum notice period (we use 6 months for public APIs), runtime warnings, and a clear sunset date enforced by metrics on usage.

DEX is the unsexy lever with the biggest leverage on velocity. A new hire who can ship a small change to prod on day three has working CI, sensible test data, and a local environment that mirrors prod. Most teams have none of those and wonder why they're slow.

DORA is the cleanest available signal for whether your engineering org is healthy. Elite teams deploy multiple times per day with under 5% change failure rate; low performers ship monthly and roll back half the time. We instrument these on every long-engagement and review them with leadership monthly.

It mandates lawful basis, data minimisation, breach notification within 72 hours, and registration of data controllers and processors. The ODPC has shown teeth — enforcement actions and fines against real companies are now public. Treat it like GDPR, not a soft regional cousin.

For software, EAC matters mostly because Kenya, Uganda, Tanzania, and Rwanda are converging on cross-border data and payments protocols. If you're building a regional product, design for KES, UGX, TZS, and RWF currencies and the four overlapping (but not identical) regulators.

Edge functions cut perceived latency for static-heavy sites and personalisation, but the runtime constraints (size, CPU, no long-lived sockets) are real. Don't put your payment flow at the edge — put your A/B test cookie there.

Embeddings are the foundation under every RAG system and semantic search product. Pick a model (OpenAI text-embedding-3, Cohere multilingual, BGE) based on dimensionality, language coverage, and cost — multilingual matters a lot in African deployments where your queries mix English, French, Swahili, and Twi.

A user remains the same entity even when their email changes; a money amount, by contrast, is a value object with no identity. The distinction matters because entities have lifecycles, persistence, and concurrency concerns that value objects don't.

For African IoT and travel-tech products, eSIM removes a real friction — provisioning a fleet of devices or roaming customers no longer needs a SIM logistics chain. The catch: not every African MNO supports eSIM reliably yet, so dual-mode hardware is still the safe bet.

ETags + If-Match are the boring, reliable way to do optimistic concurrency in REST APIs and avoid lost updates. Most teams skip them and then write a bug ticket six months later titled "sometimes two users overwrite each other."

Untested failover is theatre. We rehearse ours quarterly with documented runbooks and synthetic load — the systems that survive the first real outage are the ones that have already failed over a dozen times in drills.

If you take card payments via a UK acquirer, sponsor a UK e-money issuer, or sell to UK businesses, FCA expectations land on your architecture — operational resilience rules, consumer-duty obligations, and SCA enforcement all apply. Plan for it before the partnership term sheet, not after.

Flags are the single best decoupling tool we own — they separate deploy from release, enable progressive rollouts, and provide instant rollback. The discipline cost is flag hygiene: every flag is a fork in your code, and flags that never get cleaned up turn into permanent if-statements nobody understands.

Fine-tuning is usually the wrong first answer. Try prompting, then RAG, then fine-tuning. It earns its place when you need a specific tone, structured output, or knowledge that doesn't fit in a prompt window — not because the base model said something embarrassing once.

African fintech is mobile-money-first, agent-network-heavy, and regulator-watched. The technical problems aren't novel; the constraint set (intermittent connectivity, multiple currencies, fragmented KYC sources, hot-button regulators) is.

Fixed-bid works for well-bounded work (discovery sprints, design phases, integrations against a known spec). For genuine product development, fixed-bid produces either change-order battles or padded estimates — we default to time-and-materials with capped monthly burn for build phases.

GDPR applies extraterritorially whenever you process EU residents' data, including African businesses with EU customers. Most African data laws (NDPR, NDPC, KDPC) borrow heavily from it, so being GDPR-ready is mostly a strict superset of being locally compliant.

Ghana Card has become the de facto KYC anchor for Ghanaian fintechs and banks. The NIA verification API has rate limits and uptime quirks worth designing around — we cache verification proofs and rotate to backup checks (phone-tied SIM registration data) when the primary endpoint hiccups.

Any payment product live in Ghana ends up integrated with GhIPSS one way or another. Their MMI rail is what makes cross-MNO mobile money work, and GIP gives you real-time interbank credit transfers. We've built bridges into all three rails and the operational gotchas (cut-offs, dispute windows, fee tables) are well-trodden ground.

If your checkout breaks because the recommendation engine is slow, you don't have a recommendation engine — you have a single point of failure with a friendly name. Graceful degradation is what separates senior systems from undergraduate microservices.

gRPC beats JSON-over-HTTP for internal traffic on every metric except browser support and human readability. For external APIs, REST or GraphQL is still usually the right call; for the fan-out behind your gateway, gRPC pays for itself in latency and contract safety.

Hallucination is not a bug; it's a feature of how generative models work. RAG, structured-output constraints, evaluation harnesses, and human review in the loop are the standard mitigations. The wrong response is "tell the LLM to stop hallucinating in the system prompt."

HIPAA is US-specific but matters for African healthtechs serving US patients, partnering with US providers, or processing claims through US payers. Most African jurisdictions don't have a direct equivalent yet, so HIPAA + GDPR is often the de-facto bar for serious healthtech.

HMAC-SHA256 is what you use to sign webhooks and internal API calls when full mTLS is overkill. Don't roll your own — use the standard library, include a timestamp in the signed payload to prevent replays, and rotate secrets on a schedule.

HSMs are required for PCI-DSS card-data handling, payment processor key signing, and the higher tiers of BoG's payment-systems compliance. Cloud HSMs (AWS CloudHSM, GCP Cloud HSM) make this less painful than colocating a physical Thales box in a Ghana data centre.

Hybrid is not a dirty word — for banks, government, and any client with strict data-residency or licence constraints, it's often the only legal answer. The trap is treating it as two separate stacks; the value only appears when identity, monitoring, and deployment are unified across both.

Permissioned ledgers solve a narrow class of problems — multi-party reconciliation with low trust between participants. Hyped to death; useful in about 10% of contexts where it gets proposed. For most "blockchain" pitches you can swap in a Postgres database and a notary service and ship a year earlier.

IaC is non-negotiable for any infra you couldn't fully reconstruct in 24 hours if it vanished. Terraform, Pulumi, and CDK are all defensible choices — what kills teams isn't the tool, it's skipping the discipline of code review, drift detection, and modular structure.

Any API that creates or moves money without an idempotency key is a duplicate-charge waiting to happen. We use UUIDs scoped to the operation, store them with a TTL, and return the original response for retries — Stripe's implementation is the de facto reference.

SWIFT, SEPA, and most modern instant-payment rails (including CBK's and the upcoming Pan-African rails) require ISO 20022 messages. If you're building anything that talks to a real-time gross settlement system, schema-first design against pacs/pain/camt messages will save you months later.

ISO 27001 is the "serious enterprise" bar for security maturity. Unlike SOC 2, it's a certification of your ISMS process rather than a snapshot of controls. The first cycle takes 9-12 months done honestly; the rebrand-only versions sold on Fiverr are exactly what they sound like.

ITIL is everywhere in government and large enterprise procurement, less so in product engineering. Borrow the bits that fit (clear incident severities, change records, problem reviews) and ignore the parts that turn delivery teams into ticket-shufflers.

Jaeger answers "where did that request spend 2.4 seconds?" for distributed systems. Most teams instrument it and then never look at it — the value only lands when traces are correlated with logs and a debugger can jump from a slow user complaint to a root span in under a minute.

Jepsen reports are the closest thing distributed databases have to honest scorecards. If your vendor claims linearisable transactions and Jepsen hasn't blessed them, treat the claim as marketing until proven otherwise.

JWTs are the right tool when you need cross-service identity propagation without a session store. They're the wrong tool when you need short revocation windows (you can't revoke a JWT without a denylist, which defeats the point) or when sensitive data ends up in the payload because someone forgot it's base64, not encrypted.

Kafka is overkill when you have a single team and three services; it's indispensable when you have ten teams and forty. Managed Kafka (Confluent Cloud, MSK, Aiven) is almost always the right call — running it yourself in Africa with reliable cross-zone networking is a full-time job.

KDPC has issued real fines and ordered service suspensions for non-compliant processors. Registration of data controllers and processors is mandatory above certain thresholds — confirm where your project lands before you go live, not after.

KMS is the right default for encrypting data at rest in cloud. Use envelope encryption (data key encrypted by KMS master key), rotate annually, and treat the master-key access policy as a high-value asset itself — it's the metaphorical key to the safe.

Kubernetes is wonderful when you genuinely need cluster-wide bin-packing, multi-tenancy, and a real platform team. It's a footgun when you have three services and would be happier on ECS Fargate or Cloud Run. Most teams reach for it too early.

African KYC is fragmented — Ghana Card eID, NIMC NIN, Kenyan Huduma, Nigerian BVN, plus passport and driver's licence flows. We build orchestration layers that pick the right primary source per customer segment and fall back gracefully when the national endpoint is having a bad afternoon.

Lambda is great for spiky, event-driven workloads and glue code. It is not great for low-latency synchronous APIs (cold starts), long-running jobs (15-minute hard limit), or anything with sustained throughput where you'd be cheaper on Fargate or EC2.

LangChain helps you ship a demo in two days and a production system in six painful months. We treat it as a useful prototyping toolkit but rebuild the hot paths against raw provider SDKs for production — the abstraction churn is real and the layers obscure the latency model.

LDAP isn't dead; it's just hidden behind Azure AD, Okta, and Google Workspace. For on-prem and government clients, raw OpenLDAP or Active Directory is still daily reality, and integrations need to handle it cleanly.

Liveness probes should detect "dead but not crashed" states — deadlocks, infinite loops, exhausted thread pools. They should not double as a readiness check, and they should not include downstream dependencies, or one bad database hiccup restarts your whole fleet.

LLMs are extraordinary general-purpose tools and terrible at being deterministic. Treat their output as "plausible draft" rather than "answer," design for hallucination, and instrument every prompt in production so you can debug the failures that will absolutely happen.

Two meanings, both relevant. In software, it's how you avoid total collapse under spike load. In African infra (especially South Africa and Ghana), it's the rolling power blackouts your data centre and field hardware need to survive. We design for both.

Lockstep upgrades are the "microservices that are actually a distributed monolith" smell. If service A and service B must deploy together, they're one service spread across two repos, with all the cost and none of the benefit.

Daraja is the most mature mobile-money API on the continent and still has rough edges (callback reliability, sandbox parity, OAuth token lifetimes). Our integration pattern uses persistent retry queues with idempotency keys plus a reconciliation job that catches the inevitable callback misses.

SMS-based MFA is better than no MFA but worse than TOTP or WebAuthn — SIM-swap fraud is a daily reality in African markets. For privileged accounts (admin, finance, on-call), require WebAuthn or hardware keys and stop pretending SMS counts.

Mobile money is the foundation of African retail finance — M-Pesa, MTN MoMo, Airtel Money, Orange Money, Wave. Building on it means accepting USSD as a first-class channel, designing for intermittent connectivity, and integrating with agent commission engines that don't look like anything in your CS textbook.

MoMo is the largest mobile-money platform by user count, especially dominant in Ghana, Uganda, Côte d'Ivoire, and Rwanda. The API is cleaner than most regional alternatives but still has per-country quirks — we maintain country adapters above the SDK so feature parity matches our customers' expectations.

Multi-region is the only honest answer to "what happens if af-south-1 has a bad day?" The cost is real — data replication, cross-region egress, eventual-consistency design — and most teams don't need it until they have a regulator or an SLA that says they do.

Multi-tenancy spans a spectrum from shared everything (row-level isolation) to shared nothing (per-tenant infra). The right point on the spectrum depends on your security model and the largest customer who will ever sign — get it wrong early and you'll be rebuilding it instead of shipping features.

NDPC registration is mandatory for data controllers in Ghana and has real teeth — failure to register or comply attracts fines and named enforcement. Treat NDPC engagement the way you'd treat the tax authority: keep clean records and don't miss renewals.

NDPR + NDPA require lawful basis, DPO appointment above certain thresholds, breach reporting, and annual filings. Don't conflate the Nigerian NDPC with the Ghanaian one; they share an acronym but not a regulator.

Any Nigerian fintech eventually integrates with NIBSS for NIP transfers and BVN validation. The integration is mature but the rate-limit and dispute processes are unforgiving — design for it, don't fight it.

NIN verification is now mandatory for SIM activation and major financial onboarding in Nigeria. The NIMC verification rails have improved but still benefit from caching verification proofs and falling back to BVN when NIMC is slow.

NIST CSF is the lightest-weight serious security framework — useful as a north star even if your formal certification path is ISO 27001 or SOC 2. We map controls back to CSF functions in board reports because executives can hold the five-pillar picture in their heads.

NITA matters for anyone building government-facing systems in Ghana — they certify data centres, govern interoperability, and run the GovCloud. If you're selling to MDAs, expect NITA compliance language in the RFP and plan for it.

OAuth 2.0 is the protocol; OIDC sits on top for identity. Use the Authorization Code flow with PKCE for everything new (including SPAs and mobile), and never invent your own grant type because a junior dev thought refresh tokens looked annoying.

Observability is "monitoring" with the assumption that you don't know in advance which question you'll need to ask. High-cardinality fields, structured logs, and trace-log correlation are the practical investments that turn outages from multi-hour mysteries into 20-minute fixes.

OIDC is what you actually want when you say "OAuth login." The discovery document and well-known endpoints make integration straightforward; the trap is verifying the ID token signature and audience instead of trusting the contents on faith.

Okta is one of three sensible defaults (the others being Microsoft Entra and Google Workspace IdP) for clients big enough that DIY identity becomes a liability. The cost stings; the alternative — your engineers maintaining Keycloak — usually stings more.

OPA shines for cross-cutting policy — Kubernetes admission control, service-mesh authorisation, infra-as-code guardrails. For per-feature business authorisation, native code is usually clearer than another DSL.

OTel is the right default for new instrumentation — it decouples your code from your observability vendor and works with Jaeger, Tempo, Datadog, Honeycomb, and most others. The collector pipeline takes a little getting used to but eliminates the "rewrite all our instrumentation" conversation later.

ASVS is the most practical "what does secure-enough look like?" reference for application security. We use L2 as the default bar for production apps and L3 for systems handling payments or PII at scale. It pairs nicely with SAST/DAST for evidence.

Pinning protects mobile fintech apps from sophisticated MITM attacks, but pin-failure incidents (expired cert, key rotation) are spectacular when they happen. Use backup pins, build a kill-switch for emergencies, and exercise the rotation process before you need it.

PCI-DSS scope reduction is half the architectural battle — minimise where card data touches your systems with tokenisation, hosted fields, and a qualified payment processor. Going for full Level 1 certification yourself is expensive and slow; for most fintechs, scope-reduction plus a PCI-compliant processor is the right answer.

Annual pen-tests are the floor, not the bar. A good pen-test report is uncomfortable reading; a clean one usually means the scope was wrong or the tester was too gentle. We retest findings after remediation rather than trusting fix-it-yourself screenshots.

Post-mortems only work if they're genuinely blameless and the action items have owners and dates. The cultural shift — from "who broke it?" to "what made it easy to break?" — is the hard part, not the template.

Pre-mortems flush out the risks that polite kickoff meetings hide. We run them at the start of every significant engagement — fifteen minutes of structured pessimism saves weeks of corrective action later.

PSD2 doesn't directly bind African operators, but it shapes the EU acquirers and banks they partner with, which means SCA flows and 3DS2 ripple into African payment integrations whenever European cards or accounts are involved.

The Pyramid Principle is why a good engineering memo can be skimmed in 30 seconds and still convey the decision. We use it for ADRs, board updates, and any document where the reader's time is a constraint.

Raw QPS without latency is meaningless — 10,000 QPS at 5-second p99 isn't a system, it's an outage in slow motion. Always pair QPS targets with p50/p95/p99 latency and error rate.

Quiet hours are an on-call hygiene tool — they force you to tune your alerts to "does this genuinely need a human now?" If you can't implement quiet hours without fear of missing something, your alerting is broken, not your schedule.

Quorum is why three-node clusters are everywhere — they survive one failure and still elect a leader. Five-node clusters survive two failures at the cost of more chatter; even-node clusters are footguns because they can deadlock on ties.

RACI is a 1980s tool that survives because the question it answers — "who actually owns this?" — never goes out of fashion. We use a lightweight version on cross-team programmes; full RACI matrices for small teams are bureaucratic overkill.

RAG is the default starting point for any "chat with our knowledge base" product. The interesting engineering is in chunking, embedding choice, hybrid retrieval (keyword + vector), reranking, and evaluation — not in the LLM call at the end.

Token-bucket and sliding-window are the two algorithms worth knowing. Apply rate limits at the gateway for cheap protection, and at the service layer for fine-grained business rules. Return clear 429 responses with Retry-After headers, or you'll be debugging client retry storms instead of the original issue.

Readiness probes are how you tell the load balancer "don't send me anything yet, I'm still warming up the cache." They're also how a single Redis hiccup can take your whole fleet out of rotation — choose downstream checks carefully.

RPO is set by the business, not the SRE team. "Zero data loss" sounds nice until you cost it out — synchronous cross-region replication isn't free in dollars or latency. Pick a defensible number per dataset and design backups around it.

RTO and RPO together define your disaster-recovery posture. A 15-minute RTO is achievable with warm standby; a 30-second RTO means active-active and the cost that comes with it. Match the number to actual business impact, not what sounds impressive in a slide.

Refactoring is a deliberate engineering activity backed by tests, not a six-month rewrite labelled with the same word. If you can't describe the change in one sentence and the safety net in another, you're rewriting, not refactoring.

Read-your-writes bugs are almost always replication-lag bugs in disguise. We monitor lag explicitly, route critical reads to the primary, and design UIs that tolerate "your change is being processed" rather than pretending replicas are instant.

"Roll forward" sounds heroic; rollback is what saves the night. Every deployment needs a rehearsed rollback path, ideally a single command, and feature flags make this nearly free for application code. Database migrations need more care — additive-only changes plus a deprecation window beat "down migrations" that no one ever tests.

"SaaS" tells you almost nothing technically — it's a billing model. The architectural choices that define a real SaaS (multi-tenancy, self-service onboarding, metered billing, controlled customisation) are the actual work.

SAML is OIDC's older sibling. New applications should default to OIDC, but if you're selling to a bank, ministry, or large enterprise, SAML support will be in the procurement form. Support both; let the customer pick.

SAST in CI catches the obvious classes — SQL injection patterns, hardcoded secrets, unsafe deserialisation — cheaply. False positives are real; the trick is tuning rules and treating SAST as a complement to DAST and pen-tests, not a substitute.

SCA combines two of three factors: knowledge, possession, inherence. For card payments, 3DS2 is the dominant SCA implementation. African operators serving European customers or partnered with European acquirers inherit SCA obligations whether they planned to or not.

A good SDK saves integrators days; a bad one costs them weeks of fighting the abstraction. The bar we hold ours to: idiomatic per language, typed where the language allows, sensible defaults, and escape hatches when the abstraction fails.

SemVer is a contract with your consumers, not a vanity label. If you bump PATCH on a breaking change, you owe whoever broke. We pair SemVer with deprecation policies and a CHANGELOG that reads like a release note, not a git log.

Service meshes solve real problems in large Kubernetes estates and add real complexity in small ones. We add Linkerd when teams pass a half-dozen services and need uniform mTLS and traffic policy; we stay out of meshes when a few well-instrumented services can do the same job directly.

An SLA without an SLO behind it is a marketing slide. We publish customer SLAs that are deliberately less strict than the internal SLOs we operate against, so we have engineering headroom before a contractual breach.

Good SLIs measure what users actually experience: not "CPU usage" but "percentage of checkouts that completed under 2 seconds." Bad SLIs measure what's easy to graph. The shift from infrastructure metrics to user-experience SLIs is the maturity threshold most teams haven't crossed.

SLOs are the cleanest way to translate "reliable enough" into a number engineering and product can both reason about. The error budget that falls out of the SLO is the practical tool — it tells you whether the next release can ship or whether you owe reliability work.

Type I is a snapshot; Type II covers a period (usually 6-12 months) and is what enterprise customers ask for. SOC 2 isn't a security guarantee — it's evidence of disciplined controls. Pair it with ISO 27001 if you're selling globally.

SRE is what you get when you treat "keeping the lights on" as a software problem with code, tests, and shipping cadences, rather than a ticket queue. Without SLOs and error budgets, an "SRE team" is just ops with new business cards.

StatefulSets give you per-pod identity and stable PVCs, which sounds great until you have to manage backup, restore, and rolling upgrades of a real production database on top of them. For most stateful workloads, managed cloud services beat self-hosted StatefulSets on TCO and pager pain.

Stateless services scale horizontally without coordination, which is why they're the default for HTTP APIs. "Stateless" doesn't mean no state exists — it means the state lives somewhere designed to be shared (Redis, Postgres, S3), not in process memory the next request can't reach.

Every cloud provider and SaaS in your stack is a sub-processor. GDPR, NDPC, KDPC, and NDPR all require you to maintain a public sub-processor list, notify customers of changes, and have DPAs in place. Treat the list as code: version it, review it, automate the diff.

Tabletops are cheap, high-leverage practice. We run them quarterly with realistic scenarios — "BoG just asked for a 72-hour breach report, what do we have?" — and update the runbooks where reality and the script diverge. Most are humbling.

Averages lie; tails kill. The user who experiences a 5-second p99 page load doesn't care that your p50 is 80ms. Optimise the tail (cold starts, garbage collection, lock contention, downstream slow queries) and the average takes care of itself.

Backpressure is what stops a slow downstream from causing the upstream to OOM. Application-level backpressure (reactive streams, bounded queues, 429s with Retry-After) is what you build when TCP-level alone isn't enough — usually when async or batched processing is involved.

Temporal is what you reach for when retries, compensations, timers, and human approvals scattered across cron jobs and queues become unmaintainable. Onboarding flows, KYC pipelines, payment reconciliation — anywhere a state machine wants to be born — fit it well.

Tenancy models span single-tenant (per-customer infra), pool with row-level isolation, silo with per-tenant database, and bridge models in between. Each has trade-offs on cost, security posture, blast radius, and per-tenant customisation — pick deliberately, document the choice in an ADR.

T&M aligns incentives on genuine product work — neither side has to game scope to protect a fixed price. We run it with capped monthly burn, weekly burn-rate reporting, and a co-owned backlog so the customer always knows what they bought this month.

TLS 1.3 dropped the legacy cipher suites and cut the handshake to one round trip. There is no good reason to support TLS 1.0/1.1 in 2026, and 1.2 stays only where ancient clients (some bank middleware, government appliances) force the issue. Enforce 1.3 everywhere it's practical.

TOGAF is most useful in environments where procurement and governance require it; for product engineering teams it's usually too much process for too little payoff. We adopt TOGAF artefacts selectively when our customer's estate is genuinely TOGAF-shaped and ignore them when it isn't.

One trace tells a story; aggregated traces tell you where the system spends its time. Sample heavily on the slow tail and on errors, lightly on the happy path, and correlate trace IDs into your logs.

Tracing pays for itself the first time you cut a multi-day "why is this slow?" investigation to twenty minutes. Get the instrumentation as close to the framework boundary as possible so app developers don't fight it, and let OpenTelemetry handle the wire format.

UAT works when the acceptance criteria were defined up front and the environment mirrors production. It fails when it's used as a fallback for "requirements were vague," turning into a months-long renegotiation. We write UAT scripts during discovery so the bar is shared before code starts.

"99.9% uptime" sounds good until you do the math: ~8.7 hours of allowed downtime per year. Make sure the measurement window, what counts as "down," and the exclusions (planned maintenance, third-party outages) are all spelled out — otherwise you're negotiating against an undefined number.

USSD is not legacy in Africa; it's the dominant channel for mobile banking, mobile money, and government services on the most common handsets. We design USSD flows as first-class products with their own session models, latency budgets (telcos hard-cut around 60-180 seconds), and accessibility considerations.

Vault is the right answer when secrets sprawl outgrows .env files and parameter store. Dynamic database credentials, short-lived cloud creds, and PKI issuance are where it really earns its keep. Operationally, plan for HA, unseal procedures, and a credible backup story — losing Vault is much worse than losing a regular database.

Pinecone, Weaviate, Qdrant, pgvector, and Milvus are the usual suspects. For most RAG projects, pgvector inside an existing Postgres is the lowest-friction starting point; dedicated vector DBs earn their keep when scale, multi-tenancy isolation, or hybrid retrieval needs justify the operational overhead.

All vendors lock you in to some degree; the honest question is "how much, and is it worth the value we get?" We document expected lock-in per major dependency, design migration escape hatches where the cost would be painful, and accept lock-in where it buys real velocity (e.g. managed Postgres beats hand-rolled HA every time).

API versioning is a design choice with three honest options: URL path (/v2/), header, or accept-type. Pick one and stick with it. The more important discipline is having a deprecation policy that lets old versions retire on a schedule consumers can plan around.

Vouchers are everywhere in African retail — airtime top-ups, agricultural input subsidies, government cash transfers. The interesting engineering is in the lifecycle (issue, distribute, redeem, expire, reconcile) and in fraud controls that survive contact with a mobile-money agent network.

VPC design (CIDR ranges, public/private subnets, NAT, peering, transit gateway) is where most cloud security mistakes are made early and discovered late. Plan IP space and segmentation before the first workload lands; reorganising a populated VPC is a multi-quarter project.

Corporate VPNs are slowly being replaced by zero-trust patterns (Cloudflare Access, Tailscale, Google BeyondCorp) that drop the implicit-trust-after-login model. For now most enterprises run both; the migration path is real but rarely fast.

WAFs are useful as defence in depth and as a quick patch when a vuln is disclosed before you can ship a code fix. They are not a substitute for fixing the underlying issue. Cloudflare, AWS WAF, and Akamai are the practical defaults.

WAL is what makes crash recovery and replication possible in Postgres, MySQL, Kafka, and most modern databases. It's also the foundation of CDC — every CDC pipeline you've seen is fundamentally a downstream consumer of a WAL.

Wardley Maps are the most useful 2D strategy tool we use — they expose where engineers are hand-rolling things that should be commodity (and the reverse). We run them at the start of digital-transformation engagements; the maps end up changing roadmaps far more than the slide decks do.

WCAG 2.2 AA covers contrast, keyboard navigation, focus indicators, error identification, and dozens of other criteria. We design and audit against it on every public site; retrofitting accessibility after launch costs roughly 5x what doing it during build costs.

Webhooks save polling cost but transfer reliability problems to the consumer. The bare minimum: signed payloads (HMAC), retry policy with exponential backoff, idempotency keys, and an ops dashboard showing delivery failure rates. Without those, "sometimes webhooks just don't arrive" becomes a permanent feature.

Verifying signatures is the difference between "our webhook endpoint" and "an open RCE on our finance team." Include a timestamp in the signed payload to prevent replays, and reject anything older than a few minutes.

XSS is still in the OWASP Top 10 decade after decade because every new framework finds a fresh way to break the escaping rules. Default to framework-provided escaping, set a strict CSP, and treat any innerHTML-style API as a code smell.

YAGNI fights the speculative-generality reflex that turns simple code into pluggable nightmares. The honest version is "don't build it until you have two concrete use cases" — the second one tells you what the abstraction actually needs to do.

"I just need to fix this bug" turns into "I need to update the linter, which needs a new Node version, which needs Docker, which needs a registry login..." — at some point you've shaved a yak. Sometimes necessary, often a sign your dev environment owes you maintenance.

Zero trust replaces "inside the VPN equals safe" with per-request identity and policy checks. It's a multi-year journey for any non-trivial estate — identity, device posture, network segmentation, and policy engines all have to move in step. Don't buy the slide deck; buy the migration plan.

ZRS protects against a single-zone outage but not a regional one — for full DR you still need cross-region replication. The performance penalty of synchronous cross-zone writes is real; quote latency from the slow zone, not the fast one.

12-factor is showing its age (some assumptions don't map cleanly to serverless or stateful systems) but the core ideas — config via env, stateless processes, port binding, parity between dev and prod — are still the right defaults. Treat it as a checklist, not a religion.

2FA is the minimum acceptable bar for any account that touches money or personal data. TOTP apps (Google Authenticator, Authy) beat SMS for everyone but the smallest set of users who genuinely can't install an app. Hardware keys (YubiKey, Titan) beat both.

3-tier is the workhorse of enterprise software, and the right answer for most internal apps even in 2026. Microservices replaced "application tier" with "many services" for some teams; for everyone else, a well-built 3-tier app on Postgres and a sensible API is still where the value lives.

Four nines is achievable but expensive: multi-region, active-active, deep redundancy, and a 24/7 on-call that actually answers. Each additional nine roughly multiplies the architectural and operational cost — make sure the business outcome justifies the engineering bill.