# Why operators need idempotency keys too

Canonical: https://stevenmoriasi.com/blog/operations-command-center
By [Steven Moriasi](https://www.linkedin.com/in/steven-moriasi/).
Source: https://github.com/steven-moriasi/operations-command-center
Date: 2025-10-22

## Context

The operator console is part of the control plane. A workflow engine without a safe human surface trains people to bypass the controls at 2 a.m.

[Operations Command Center](https://github.com/steven-moriasi/operations-command-center) is that surface: dashboard metrics, execution state, retry and cancel, OIDC authorization-code with PKCE, and tenant-scoped audit.

## Decision

Action requests require an `Idempotency-Key` and an `expectedVersion`. PostgreSQL row locks and advisory locks back the workflow actions. The browser session is not a homemade cookie the API blindly trusts. Fixture auth exists so you can review the UI without Keycloak; OIDC mode is the real path.

## What I rejected

A “Retry” button that POSTs with no key and no version. Double-submit and two tabs would start two recoveries. I also rejected letting the UI call internal worker URLs directly.

## Failure scenario

Two operators hit Retry on the same exhausted run. One request wins the version. The second returns 409. Audit records who acted, on which tenant, with which key.

## Evidence

Authenticated Next.js console, optimistic-concurrency tests, and tenant audit history in PostgreSQL. Pair it with the identity gateway so the session and the API agree.

Inspect: [Repository](https://github.com/steven-moriasi/operations-command-center) · [Run locally](https://github.com/steven-moriasi/operations-command-center#readme)

_—by [Steven Moriasi](https://www.linkedin.com/in/steven-moriasi/)_