Order model
One canonical order independent of channel.
Why. Add channels without redoing fulfilment.
Trade-off. Mapping per channel.
Industry patterns · Retail and distribution
Retail order and inventory integration
Orders from web, marketplace and in-store channels flow to one order management layer, with inventory, fulfilment and accounting kept in step and a clear view of stock.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- Australian Privacy Principles
- ACSC Essential Eight
- PCI DSS scope reduction through hosted payments
- Australian Consumer Law
Architecture
- People and clients
- SaaS and business systems
- Network and edge
- Messaging, events and workflow
- Compute and containers
- Security and identity
- Monitoring, audit and analytics
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
Each channel sends orders by signed webhook or API. The ingest API validates and normalises them to one format.
Validated orders go onto a queue and event bus with a unique channel order ID for idempotency.
The order service creates the order, applies rules (fraud flags, shipping method) and tracks its state.
The inventory service reserves stock and publishes availability back to channels to prevent overselling.
Fulfilment instructions go to the warehouse or 3PL, with status and tracking numbers coming back.
Accounting receives invoices and payments with the correct GST treatment, reconciled daily.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Ingest API with signature verification | Channel intake. | Reject forged webhooks. |
| Amazon EventBridge and SQS | Event distribution and buffering. | Absorbs sale-day spikes. |
| Order service (DynamoDB) | Order state machine. | Single order view. |
| Inventory service | Stock with reservations. | Avoids overselling. |
| WMS and 3PL integration (API, EDI, SFTP) | Fulfilment. | 3PLs vary in capability. |
| Accounting integration | Invoices and payments. | Finance sees every sale. |
| Hosted payment providers | Card handling. | Keeps PCI scope small. |
| Reconciliation job | Orders, payments and stock. | Catches drift. |
Design decisions and trade-offs
Stock accuracy
Reservations with buffer stock on marketplaces.
Why. Marketplace penalties for overselling.
Trade-off. Some stock sits unlisted.
Spikes
Queue everything, scale consumers.
Why. Sales events are bursts.
Trade-off. Eventual consistency.
Buy vs build
Use an OMS or ERP module if one fits.
Why. Do not rebuild commodity features.
Trade-off. Licence cost.
Well-architected pillars
Security
Private networking, IAM Identity Center and Cognito with MFA, encryption with customer-managed keys, least-privilege roles and WAF on the public edge.
Reliability
Multi-AZ services, backups with tested restores and queue-based retries for integrations.
Performance
Edge caching for public content, asynchronous processing for anything slow and indexes tuned to the main queries.
Cost optimisation
Scale with demand, use reservations or savings plans for the steady baseline and set budgets and alerts per environment.
Operational excellence
Infrastructure as code, pipeline deployments with rollback, dashboards on service-level objectives and runbooks for the top failure modes.
Sustainability
Right-size, schedule down non-production and archive data to colder tiers on a retention schedule.
Network, identity and data
Networking
VPC with public, private and isolated data subnets and VPC endpoints. Public ingress only through the edge service with WAF. Private connectivity to on-premises or partner systems by VPN or dedicated link.
Identity and least privilege
Channel credentials in Secrets Manager. Staff by SSO. Warehouse partners with scoped keys.
Data and encryption
Customer addresses and contact details are personal information. Minimise, restrict and set retention. Never store card numbers.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Required for staff and administrators. Essential Eight. |
| Restrict administrative privileges | Just-in-time elevation and separate admin accounts. Essential Eight. |
| Regular backups | Automated backups with a copy held outside the workload account or subscription. Essential Eight. |
| Privacy and security of personal information | Encryption, access logging and retention support APP 11. |
| Logging | Central, tamper-resistant logs support ISM event logging guidance and ISMF expectations. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOMinutes for zone failure; hours for a rebuild from code
- Target RPOSeconds to minutes with point-in-time recovery
- Scaling and limitsSized from measured peak demand with a load test before go-live. Check service quotas early.
| Failure mode | Mitigation |
|---|---|
| Duplicate webhook | Idempotent on channel order ID. |
| Oversell | Reservation, buffers and fast stock publish. |
| 3PL outage | Queue, retry and customer messaging. |
| Accounting mismatch | Daily reconciliation and alerts. |
Observability and runbooks
- Service-level objectives for availability and latency with burn-rate alerts.
- Audit log review for sensitive actions.
- Queue depth and integration error dashboards with a named owner.
Cost drivers and levers
Compute, database, data transfer and licences for any SaaS components.
- Reserve the baseline.
- Schedule non-production down.
- Cache and compress at the edge.
- Archive old data.
Implementation and fit
Phased approach
- Discovery: process, data and obligations mapped with the business owner.
- Foundation: landing zone, network, identity and pipeline.
- Thin slice: one journey end to end in production for a small group.
- Expand and harden: remaining journeys, load and penetration testing.
Anti-patterns to avoid
- Building before the decision rights and audit needs are agreed.
- A single shared admin role.
- Personal data in logs and test data.
- Integrations without retries or a dead-letter path.
When to use it
- Multi-channel sellers and distributors.
- Teams managing stock in spreadsheets.
When not to
- A single store with one fulfilment path.
- Where an OMS product covers everything.
More in industry patterns
Utilities and field services
Field inspection and asset maintenance
Inspectors capture evidence on mobile devices, offline if needed. Findings flow to the asset register and generate work orders with a complete, timestamped evidence trail.
Aged care and community services
Aged care and community services administration
Client records, rosters, care plans and incident reporting connected on a Microsoft stack, with consent, family access and regulatory reporting handled deliberately.
State government
Citizen service portal for state government
A public channel for an application, a payment and a case, with the decision kept with an officer and a full audit trail, hosted in Australian regions.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.