Design workshop ilikuwa na watu ambao kawaida hawakai meza moja: engineers, agents, customer support, finance, privacy counsel, savings-group representatives na Ruth Atieno.
Lead engineer, Kamau, alianza kwa confession ya kiufundi.
“Phone number ilikuwa shortcut.”
Mariam akasema, “Shortcut ya nini?”
“Customer identity. Zamani tulikuwa na account key, lakini systems nyingi downstream zilitumia number kama stable identifier kwa sababu ilikuwa easy.”
Ruth akainua mkono. “Lakini number si stable.”
“Exactly.”
Kamau akaonyesha architecture ya zamani. Namba ikirecycle, ingestion inaweza kuunganisha historical key ikiwa closure metadata haikutafsiriwa vizuri.
“Tunataka durable customer ID tofauti na phone contact,” alisema.
Agent mmoja akapinga. “Onboarding itakuwa slow. Customers wa market hawataki forms ndefu.”
Aisha akasema, “Split identity haimaanishi kuongeza forms zote. Inamaanisha system haifanyi assumption kwamba same number ni same person.”
Privacy counsel akaongeza requirement: historical match kwa number recycled lazima iwe human review ikiwa kuna debt, refund, deceased closure au legal hold.
Finance ilitaka auto-reserve ibaki.
“Bila reserve, liquidity risk inaongezeka,” Njeri alisema.
Aisha hakupendekeza kuifuta. “Reserve inaweza kubaki. Lakini borrower repayment classification inahitaji source disclosure na dual approval ikiwa customer action haipo.”
Engineer akauliza, “Dual approval kila reserve journal?”
“Hapana. Kila journal inayobadilisha customer-repayment reporting au individual liability.”
Hiyo ilipunguza burden.
Workshop ikagawa rules kwenye tiers. Normal treasury liquidity movements zilibaki automated. Customer-impacting reallocations zikahitaji checker independent wa commercial KPI owner. Recycled-number matches zikahitaji identity reset token. Refunds zingeenda durable customer/estate destination, si blind phone number.
Mariam akasema, “Na agents waone nini?”
Wali-design portal field mpya: total balance, usable float, reserved amount, reason category na expected release window. Sio kila internal control detail, lakini ya kutosha agent asione KSh 180,000 kisha ashindwe kutoa KSh 20,000 bila explanation.
Beatrice wa Upendo group aliuliza kama group wallet inaweza kufungamanishwa na borrower bila member consent.
“Haipaswi,” engineer alisema.
“Haipaswi si rule.”
Wakaandika rule.
Ruth aliuliza kuhusu deceased account.
“Death closure becomes identity terminal event,” Kamau alisema. “Number inaweza kurudi kwa mtu mwingine, lakini customer key haiwezi kurudi active kwa number event pekee.”
Aisha akamwambia aandike hiyo kwenye acceptance test.
Wakati wa lunch, Victor hakuhudhuria. Board committee ilikuwa imemweka leave pending review. Aisha hakujua outcome yake. Workshop haikuwa trial ya Victor. Ilikuwa design ya system ambayo isingeweza kutegemea mtu mmoja kuwa mwema.
Baada ya lunch wali-run migration scan.
Screen ikaanza kutoa matches.
Legacy deceased closures. Recycled numbers. Dormant wallets. Old loan profiles.
Idadi ikafika 17, 29, 36.
Kamau akasema, “Hizi si necessarily wrong accounts. Ni cases zinazohitaji review.”
Aisha akakubali. “No bulk correction.”
Scan ikasimama 43.
Forty-three historical accounts zilikutana na risk conditions ambazo hazikuruhusu automation.
Agent representative akauliza, “Mtaendelea na migration usiku?”
“Kwa clean cohorts, ndiyo,” Aisha alisema. “Hizi 43 zinatoka nje.”
Mariam akatabasamu kidogo. “Finally system imejifunza kusema sijui.”
Aisha akacheka.
Workshop ikafunga design decisions kwa signatures za functions tofauti. Hakuna person mmoja aliyekuwa owner wa truth yote.
Namba ingeendelea kuwa njia ya kumfikia customer.
Lakini isingekuwa tena customer mwenyewe.
Workshop ilifanya exercise ya “what can go wrong” kwa customer mpya ambaye anapokea recycled number. Kwa architecture mpya, activation event ilitengeneza contact token mpya; historical match iliweza kuonyesha risk flag kwa system, lakini agent hakuonyeshwa jina la owner wa zamani. Ikiwa old account ilikuwa deceased, debt na refund routes zote zilibaki frozen mpaka authorized review.
Agents walipendekeza rule nyingine: portal ionyeshe reserve release estimate tu ikiwa system ina reasonable timestamp; kama haina, isiseme “soon”. Mariam alisema false precision ndiyo iliwafanya agents waahidi customers kitu ambacho hawakujua. Engineers wakaongeza status `manual review — no promised time` badala ya countdown ya kubuni.
Beatrice akataka group wallets zipate dual visibility kwa treasurer na second signatory wakati reserve inagusa group funds. Finance ilikubali baada ya discussion ya burden. Hivyo design haikuwa ya engineers peke yao. Watu waliobeba consequences waliweka controls ambazo walikuwa tayari kuzitumia. Aisha aliona system mpya ikianza kufanana na watu wake, si na diagram nzuri tu.
Engineers walionyesha migration mapping kwenye whiteboard: `customer_id` immutable, `contact_number` mutable, `estate_id` specialized, na `historical_contact` read-only. Ruth akauliza kama customer mpya anaweza kuona historical owner. Jibu lilikuwa hapana. Risk engine inaweza kujua collision; frontline agent anaona tu review required. Privacy ilibaki sehemu ya architecture, si afterthought.
Aisha akasisitiza kwamba dual approval isiwe watu wawili kutoka chain moja. Finance na commercial manager wawili ambao wote wanaripoti kwa KPI owner hawakuwa independence ya maana. Board risk representative akakubali checker wa customer-impacting reserve adjustments atoke control function yenye reporting line tofauti.
Mariam akasema human review ya 43 accounts inaweza kuchukua siku nyingi. Waka-design service priority: active customer harm na pending refund kwanza, dormant historical mismatch baadaye. Hivyo safety haikutumiwa kama excuse ya kutokuwa na speed. System mpya ilikubali kwamba baadhi ya cases zinahitaji mtu, lakini pia iliamua mtu huyo aanzie wapi.
Kabla workshop kuisha, walifanya vote ya operational acceptance, si popularity. Kila function ilisema control ipi inaweza ku-run kesho na ipi inahitaji build. Identity split, refund hold na dual approval zilikuwa blockers; portal wording na reporting cosmetics zingeweza kufuatia. Aisha alikataa launch date itangazwe kabla blockers zipite test. Agents wakakubali kwa sababu waliona tofauti kati ya “design approved” na “system safe to migrate”. Hiyo distinction ndiyo ilipeleka timu kwenye usiku wa cutover bila kudanganya kwamba workshop yenyewe ilikuwa solution.
Privacy counsel aliomba deletion policy ya historical contact data iingie architecture requirements. Durable identity haikumaanisha company ihifadhi every old phone forever. Historical contact ingebaki tu pale ambapo audit, legal hold au unresolved balance inahitaji, na access yake iwe restricted.
Migration test ilikuwa imepata accounts 43 ambazo zilihitaji mtu aseme, kwa makusudi, huyu ni nani kabla pesa, deni au refund haijamfuata.