Financial integrity enforced in the database, not the application

Where the rules live

A buggy or compromised client still cannot mutate an issued financial record.

That guarantee is only worth stating because of where it is implemented. Row-level security is enabled on all 14 tables and expressed through 24 policies, alongside roughly 41 functions, 28 triggers and 3 views. The application is one client of the database among several possible ones, and it holds no special privileges that make it trusted.

An invoice number is never recycled

Numbering is two-phase: a number is reserved, then finalised, with idempotency keys so a retry cannot consume two. A reservation that does not complete moves to a failed terminal state and that number stays permanently burned.

Reusing a number would be the tidier-looking behaviour. It is also the one that produces two different documents claiming to be the same invoice, which is precisely the situation an audit is designed to catch.

The document is checked before the number is spent

PDF preflight runs before number reservation, and the renderer's own output is then verified with pdf-lib, including a page-count check. If the document is wrong the system fails loudly instead of issuing a numbered invoice with financial content clipped off the bottom of a page.

Issued PDFs are kept as immutable versioned snapshots, so what the customer received can always be produced again exactly as it was sent.

No floating point anywhere near money

Money is fixed-precision, held as BigInt throughout. There is no path in the system where a currency amount passes through a float.

CI that proves the claims rather than restating them

This is the only one of these systems with a continuous integration pipeline, and it earns its place. On every pull request it:

• Replays all 14 migrations onto a clean PostgreSQL instance, so a migration that only works against an already-migrated database fails immediately.
• Runs 22 integration tests against real PostgreSQL which impersonate admin, finance and viewer JWTs and assert that the operations each role must not perform are actually denied. Privilege denial is tested as a behaviour, not assumed from reading policies.
• Gates migration syntax against the real PostgreSQL grammar rather than a regular expression.

AI-assisted, human-accountable. AI tools contributed significantly to the implementation described here. The specification, the review of every change, the production operation and the accountability are mine.