Put a name on every edge that can break the other side.
A retry doubles a charge. A field gets renamed without notice. The ticket bounces between two teams who each point at the connection between them. Every edge that can break the other side needs a named owner on both ends.
For each critical API or sync edge, fill the TWIMCO Integration Ownership Contract: named owner on each side, retry and idempotency expectations, schema-change notice rules, on-call path, and an explicit statement of who may ship a change that can break the other side. Without those fields, “we’ll integrate” is not ownership—it is proximity.
Connected is not owned
Two sides agree to connect the systems. Payloads start flowing. A retry doubles a charge. A field gets renamed without notice. Overnight, a change on one side breaks the other. The ticket bounces. Each side points at the edge. Nobody owns the edge.
You need a page shorter than a master agreement and more operational than an API document. Who owns the edge, on each side, and who is allowed to ship a change that can break the other.
The fields that stop the bounce
Owner, each side. A role that accepts the ticket. Not a distribution list.
Retry and idempotency. What a retry is supposed to do, and what must not happen twice.
Schema changes. How a breaking change is announced, how long the other side has, and what happens if they are not ready.
On call. Hours, channel, and what is outside the window.
Who may break the other side. The explicit answer. If the answer is "either of us, whenever it is urgent," write that down and decide whether you mean it.
"We will integrate" means the systems are near each other. It does not mean anyone owns the failure.
How the work moves
Fields on the ownership contract
- Owners
Named role each side; backup identified.
- Retry / idempotency
Who retries; keys; no duplicate harm.
- Schema notice
Breaking-change definition, notice, ack.
- On-call
Severity, hours, bridge expectations.
- Break authority
Who may ship a change that can break the other side.
If nobody is named as allowed to break the other side, everyone will—accidentally.
Do the riskiest edge first
List the production edges by how much they can hurt. Fill the page for the top one before the next vendor kickoff. Require the page before a new integration goes live.
Pair it with a smoke test of the same edge: sample payloads, a replay check, and a named owner for a write that did not land. Ownership without a test is still a hope. A test without an owner is a log nobody reads.
Keep your copy. A shared drive that only the other side can edit is their memory, not your record.
How this fails
The ticket orbits. A field disappears and the parser guesses. Retries storm because nothing is idempotent. An "urgent fix" on one side becomes an outage on the other.
If you see those, you do not have a mysterious integration problem. You have a blank page.
Put this into practice
Fill the page for one edge this week. Require it before the next integration is called done.
Ownership of the running application, including the edges, sits under web applications.
Related work: Sutton Place.
Decision guide
Connected vs owned
| Consideration | Systems connected | Edge owned |
|---|---|---|
| Ticket | Bounces between vendors. | Named owners on both sides. |
| Change | Ships when ready. | Notice rules and break authority written. |
| Retry | Client library defaults. | Idempotency and attempt policy agreed. |
| Night issue | Hope someone sees Slack. | On-call path for the edge. |
We build alongside the people doing the work.
Bring us the problem you’re thinking about.