Margin and value floors
Hard numeric limits on price, discount, refund and credit. A breach is a refusal
and an alert, not a warning in a log nobody reads.
Volume circuit breakers
If a workflow suddenly processes ten times the normal volume, it stops and asks.
Runaway automation is caught in minutes, not at month end.
Idempotency
Re-running a job does not duplicate the work. Every write carries a key so a
retry corrects rather than compounds.
Failure queue
Anything that cannot complete lands in a visible queue with the error and the
payload, not in a swallowed exception.
Archive, never delete
No workflow has delete permission on a record of consequence. Removal is an
archive plus a flag, reversible by a human.
Full step audit
Every step records its input, output, duration and outcome. When something goes
wrong you get a trace, not a theory.