Strategy · Partner environment & model risk
PRDv1.2 · In reviewowner: Card D&A Product
Card Transactions (Gold) - the partner-reporting data product
The curated, contracted, lineage-tracked transaction product that analysts, data scientists, and the Partner Aurora reporting mart all build on.
1
Problem
Today, transaction data lives across the bronze authorization stream and a sprawl of analyst-owned extracts. Each new consumer re-derives “settled, deduped, partner-scoped transactions,” re-implements entitlements inconsistently, and re-discovers the same data-quality cliffs. Onboarding Partner Aurora the old way would mean another bespoke pipeline and another bespoke access model - slow, and a compliance risk.
2
Users & personas
| persona | job-to-be-done | needs |
|---|---|---|
| Partner Aurora analyst | Report on the Aurora portfolio | Aurora-scoped rows, masked PII, SLA freshness |
| Fraud analyst | Investigate suspected fraud | All rows incl. fraud, PII unmask under purpose |
| Data scientist | Build fraud / attrition models | Tokenized features, stable schema, low latency |
| Marketing analyst | Segment & target | Spend behavior, no fraud detail, masked PII |
3
Goals & non-goals
Goals
- · One contracted gold product; consumers stop re-deriving.
- · Entitlements (row scope, purpose, masking, audit) enforced in the product, not per-consumer.
- · Partner-reporting mart derived by row-filter, not a copy.
- · p95 query latency < 5s; freshness SLA daily T+1.
Non-goals
- · Real-time (sub-second) serving - that stays on the auth stream.
- · Storing clear PAN - tokenized at rest, always.
- · A new BI tool - we serve the governed table, not dashboards.
- · Per-analyst snowflake extracts - deprecated by this product.
4
Requirements
- P0 Settle + dedupe authorizations into one row per transaction, conform MCC, attach partner scope.
- P0 Enforce RLS: partner analysts see only their scope; fraud rows gated by Fraud Prevention purpose.
- P0 Mask PAN to last-4 at rest; mask account token + PII unless the role may unmask.
- P0 Write an audit row for every access, with role + purpose.
- P1 Publish a field-level data contract with quality thresholds and breach alerting.
- P1 Derive the Partner Aurora reporting mart by row-filter with its own SLA.
- P2 Expose a governed NL-to-SQL surface that respects the same entitlements.
5
Success metrics
| metric | target |
|---|---|
| Data-product adoption (weekly active consumers) | +20-30% QoQ |
| Time-to-insight on gold | < 1 day |
| Query latency p95 | < 5s |
| Tier-1 data-quality score | ≥ 98% |
| Partner SLA adherence | ≥ 99.5% |
| PII columns masked-by-default | 100% |
6
Risks & tradeoffs
- Governance vs. speed: mask-by-default with a fast request-based unmask, rather than gate every query.
- Central vs. federated: a single gold product with global standards, mart derivation at the edge.
- RLS performance at scale: indexes on scope/purpose-referenced columns; security-definer aggregates for dashboards.
- Partner-relationship risk: co-brand deals have failed over data/servicing disputes - SLA + scope are contractual, not best-effort.
7
Rollout
- Phase 1: bronze→silver ingestion + entitlements MVP on Tier-1, audited.
- Phase 2: publish the gold product + contract; migrate first three consumers off extracts.
- Phase 3: derive the Partner Aurora mart; partner UAT against SLA.
- Phase 4: governed NL-to-SQL self-serve; deprecate snowflake extracts.