# Billing issue triage workflow blueprint

```yaml
name: billing-issue-triage
version: 1.0.0
trigger:
  events: [ticket.billing_candidate, customer.billing_reply]
input:
  required: [ticket_id, source_message_id, original_reference, policy_version]
output:
  required: [triage_id, verified_account_state, issue_classes, source_facts, exception_state, provenance]
side_effects:
  allowed: [read_permitted_billing_facts, write_redacted_packet, route_to_authorized_queue]
  forbidden: [request_card_data, copy_card_data, refund, credit, dispute_decision, fraud_finding, contract_change, account_restriction]
```

## States

`registered -> sensitive_data_checked -> identity_resolved -> classified -> facts_retrieved -> boundary_checked -> reviewed_if_needed -> committed -> routed`

Terminal exceptions: `secure_data_handling`, `identity_resolution`, `billing_source_recovery`, `billing_policy_owner`, `billing_specialist_review`, `protected_fraud_security`.

## Data rules

- Logs store source references and decision metadata, not original message bodies or credentials.
- Billing fields keep source system, record ID and observed timestamp.
- Route events contain no payment credentials.
- Service identity has read-only, least-privileged billing access.
- Authorized decisions are linked by source-system event ID and never synthesized by triage.

## Acceptance tests

1. Suspected full card number stops all derived copies and routing notifications.
2. Secure-data branch records no matched value in logs.
3. Missing account blocks billing retrieval.
4. Multiple account matches enter identity resolution.
5. Email address alone does not establish authorization.
6. Invoice-copy class can retrieve only the approved document reference.
7. Failed-payment class returns processor state and secure customer path, not credentials.
8. Duplicate-charge class cannot issue a remedy.
9. Refund/credit class always requires an authorized owner.
10. Tax/legal question routes without model interpretation.
11. Fraud signal enters the protected route with restricted detail.
12. Billing-source timeout retries without duplicate packets.
13. Field provenance survives human correction.
14. Authorized decision reference is distinct from triage completion.
15. Audit export contains no prohibited payment data.