Context
Asset-finance demos collapse into a form with a disburse button. Production needs to answer which principal may see which workspace, and whether a worker can mutate state the BFF never authorised.
Mobility Finance Event Platform is a synthetic C#/.NET reference for that door. Origination, repayments, asset operations, workflow review, and platform ops sit behind one authenticated web app.
A related decision — why broker delivery is not financial truth — lives in a separate note.
Decision
Users talk to one shell. The BFF applies role-based access in the browser and the same policies server-side. Domain services and workers stay internal. They are not a second public surface. Observability (Prometheus, Grafana) is part of the local stack.
What I rejected
Exposing each domain API to the browser with a shared JWT, and letting workers listen on a public port “for convenience.” Either choice makes RBAC a UI suggestion.
Failure scenario
A client calls an internal repayment URL directly. The request never reaches a public listener. Work that should happen still goes through the BFF, so audit and RBAC stay on one door.
Evidence
make app-start, architecture notes, Helm and Bicep assets, and a documented no-cloud-deployment boundary when the Azure gate is unused. Synthetic data only; no real lending.
Inspect: Repository · Architecture · Run locally