The redesign workshop put engineers, agents, customer support, finance, privacy counsel, savings-group representatives and Ruth Atieno around one table.
Lead engineer Kamau began with a blunt admission.
“The phone number was a shortcut.”
“For what?” Mariam asked.
“Identity. Downstream systems treated it as stable because it was easy.”
Ruth looked at him. “But it isn't stable.”
“Exactly.”
Kamau drew the old model. A recycled number could trigger an activation event that accidentally reattached a historical customer key if old closure metadata was not recognized.
The new architecture separated four things: immutable `customer_id`, mutable `contact_number`, specialized `estate_id` and restricted `historical_contact`.
A new subscriber would not see the previous owner. The system might know a collision required review, but frontline staff would see only a risk flag.
Agents worried about slower onboarding.
“Customers do not want forms because your database is complicated,” one said.
Aisha agreed. “Separating identity does not require asking the customer to solve our history. It requires the system to stop assuming the same number means the same person.”
Finance wanted auto-reserve to remain.
Aisha did not oppose that.
“Normal treasury liquidity can stay automated. Any reserve action that changes customer repayment reporting or individual liability requires independent approval and source disclosure.”
Njeri asked whether every reserve journal needed two approvals.
“No. Customer-impacting ones.”
That distinction kept the control usable.
Mariam asked what agents would see.
They designed separate fields for total balance, usable float, reserved amount, reason category and expected release window. If the system did not know an honest release time, it would say **manual review — no promised time** rather than invent a comforting countdown.
Beatrice from Upendo demanded dual visibility for group-fund reserve actions. Engineers and finance negotiated the burden and agreed on a second-signatory notification for customer-impacting movements.
Ruth asked what happened after a death closure.
“Death becomes a terminal identity event,” Kamau said. “The number may return to the market. The customer key does not return because the number becomes active.”
“Put that in the acceptance test,” Aisha said.
Independent approval could not mean two people who both answered to the same commercial KPI owner. Board risk agreed the checker for customer-impacting reserve actions would sit outside that reporting chain.
The workshop also set retention limits. Durable identity did not mean keeping every old phone number forever. Historical contact data stayed only where audit, legal hold or unresolved balances justified it.
Then they ran the migration risk scan.
Seventeen accounts.
Twenty-nine.
Thirty-six.
Forty-three.
Kamau stopped the counter.
“These are not forty-three confirmed errors. They are forty-three cases automation is not allowed to decide.”
The team prioritized active harm and pending refunds first, dormant historical mismatches later.
Before ending, every function classified controls as blockers or later improvements. Identity split, refund hold and independent reserve approval were blockers. Portal wording could follow.
A design meeting was not allowed to declare the system safe merely because everyone had signed a diagram.
The scan had found forty-three historical accounts that required a human being to answer one question before debt, money or restitution moved again:
Before the workshop closed, each function classified its proposal as a launch blocker or a later improvement. Identity separation, refund destination controls and independent approval for customer-impacting reserve journals were blockers. Better portal wording and reporting cosmetics could follow. Aisha refused to let the meeting itself be called “remediation complete.” A design can be approved while the live system remains unsafe. Agents supported that distinction because they had spent weeks hearing that problems were “fixed” when only a note or temporary override had changed. The next proof would have to be the overnight migration.
The group also designed an appeal path for identity review. A customer wrongly held because a recycled-number match looked suspicious could submit current onboarding evidence without being told who had owned the number before. A second reviewer, not the first decision maker, would clear or maintain the hold. Ruth supported the rule even though it protected future subscribers more than her family. “The man who got my mother's number did nothing wrong,” she said. That sentence reminded the room that fixing one victim's case by making another innocent person prove a stranger's history would be another form of the same mistake.
Who is this person?