ConsumerDataStandardsAustralia / standards-maintenance

This repository houses the interactions, consultations and work management to support the maintenance of baselined components of the Consumer Data Right API Standards and Information Security profile.
41 stars 9 forks source link

Define concrete NFRs for unattended traffic during high traffic periods #534

Closed ShaneDoolanFZ closed 2 years ago

ShaneDoolanFZ commented 2 years ago

Description

The Traffic Threshold NFRs for high traffic periods states:

For Unattended traffic during high traffic periods only best effort support is required.

This is proving problematic as best effort for some major data holders in CDR is read as "no effort".

Example: Adatree's Data Recipient Platform software product defined at the Register is used by Adatree for Production Verification Testing before rolling features out to customer environments. There are 5 consumers (our testing team) in this environment with one sharing arrangement each. We have an unattended asynchronous process which refreshes data every 12 hours for data that is relatively stable i.e. not transactions. With a mere 5 consumers, these twice per day calls are being throttled. In our opinion, this amounts to no effort as opposed to "best effort". The option to make unattended calls during "high traffic" periods might as well not exist.

This means the 20 sessions per day, per customer, per Data Recipient Software Product are only usable between the hours of 12am and 6am. There is no scenario we can think of where 20 sessions per customer during this period would be required as this is generally not a period when consumers would be active enough on their account to require 20 refreshes.

Area Affected

Non-functional Requirements > Traffic Thresholds

Change Proposed

Remove the wording stating:

For Unattended traffic during high traffic periods only best effort support is required.

Add the wording stating:

For Unattended traffic during high traffic periods a minimum of 1 session per hour, per customer, per Data Recipient Software Product must be supported.

By giving a usable amount of unattended sessions per customer, per Data Recipient Software Product in a 24 hour period, ADRs would be given the ability to reduce the need for a high volume of consumer present calls on login providing a better consumer experience.

jimbasiq commented 2 years ago

I would push for the "best efforts" clause to be removed entirely. It is completely ambiguous.

If a "best efforts" limit is specified it should be much higher than 1 session per hour, that is relevant for test purposes but far too low for serving a production application.

Please see this issue for further discussion on this and the general Traffic Rates topic.

CDR-API-Stream commented 2 years ago

A Decision Proposal is required #92 DSB Item - Reassess Non Functional Requirements has been added to DSBs future-plan backlog.

CDR-API-Stream commented 2 years ago

Closing this issue as it will be considered as a Decision Proposal, see comment above.