Design a Customer Support Agent

This design makes three promises to the store. A refund above 200 dollars never reaches the payment system without an employee's approval. A customer never sees another customer's data. A reply never states that a refund exists unless the payment system holds the record.

It does not promise three other things: the best possible reply, the right order chosen on the first attempt, or a model that no clever message can confuse. Code enforces the first three statements, and the second three depend on a model, so this design keeps them apart.