Customer Deployment Responsibility Matrix¶
This matrix clarifies who owns each part of a customer deployment. Adjust it for each contract, but do not leave ownership implicit.
Roles¶
| Role | Description |
|---|---|
| Paridity implementation team | Vendor or partner team that installs/configures Paridity |
| Customer platform team | Owns cloud, Kubernetes, networking, DNS, ingress, and runtime standards |
| Customer IAM/SSO team | Owns IdP, groups, claims, SAML/OIDC apps, and access reviews |
| Customer DBA/data platform team | Owns source/target database access, service accounts, warehouse controls |
| Customer replication team | Owns SLT/Qlik/GoldenGate/Debezium/Airbyte/Fivetran configuration and state access |
| Customer security/compliance team | Owns security review, evidence retention, audit, SIEM, and policy approval |
| Customer SRE/operations team | Owns monitoring, incident response, backups, upgrades, and day-2 operations |
RACI Matrix¶
Legend:
- R = Responsible for doing the work
- A = Accountable for approval/outcome
- C = Consulted
- I = Informed
| Activity | Paridity team | Platform | IAM/SSO | DBA/data | Replication | Security | SRE/Ops |
|---|---|---|---|---|---|---|---|
| Confirm deployment architecture | R | A | C | C | C | C | C |
| Select sizing tier | R | A | I | C | C | C | C |
| Provision Kubernetes | C | R/A | I | I | I | C | C |
| Provision managed PostgreSQL | C | R/A | I | C | I | C | C |
| Deploy/provision Temporal | R | R/A | I | I | I | C | R |
| Operate Temporal day to day | C | C | I | I | I | C | R/A |
| Configure backups/PITR | C | R | I | C | I | A | R |
| Configure DNS/TLS/ingress | C | R/A | C | I | I | C | R |
| Configure OIDC/SAML app | C | C | R/A | I | I | C | I |
| Define role/group mapping | R | I | R | I | I | A | I |
| Configure secret backend access | R | R | I | C | C | A | C |
| Create Paridity service accounts in source/target systems | C | I | I | R/A | C | C | I |
| Grant replication metadata access | C | I | I | C | R/A | C | I |
| Configure network allow-lists | R | R/A | I | C | C | C | R |
| Install Helm release | R | C | I | I | I | I | C |
| Run preflight and migrations | R | C | I | C | I | I | C |
| Configure systems/mappings/schedules | R | I | I | C | C | C | C |
| Validate first reconciliation run | R | I | I | C | C | C | C |
| Approve production go-live | C | C | C | C | C | A | A |
| Monitor production health | I | C | I | I | I | C | R/A |
| Perform upgrades | R | C | I | I | I | C | A |
| Patch/upgrade Temporal within Paridity support window | R | C | I | I | I | C | A |
| Respond to application incidents | R | C | I | C | C | C | A |
| Respond to cloud/network incidents | C | R | I | I | I | C | A |
| Respond to source/target access incidents | C | I | I | R | R | C | A |
| Evidence retention and purge policy | C | I | I | I | I | A | R |
Ownership Boundaries¶
Paridity Owns¶
- Product container images (published to private GHCR per release with a
digest manifest on the GitHub Release; customer pull tokens issued read-only
per
docs/runbooks/release_publishing.md) - Helm chart and reference Terraform modules
- Product configuration guidance
- Connector behavior and reconciliation correctness
- Application-level troubleshooting
- Supported Temporal version range and chart configuration
- Temporal workflow compatibility testing
- Upgrade instructions and compatibility notes
Customer Owns¶
- Cloud account/subscription
- Kubernetes or container runtime operation
- Temporal runtime operation when deployed in the customer's environment
- Network routes, firewalls, private endpoints, DNS, and TLS
- Identity provider, users, groups, and access reviews
- Source/target database accounts and permissions
- Replication tools and replication health
- Secret manager contents and access policies
- Backups, restore tests, monitoring, log retention, and SIEM
- Temporal monitoring, restart, patching, upgrade execution, backup, and restore
- Compliance approval for evidence retention and purge policy
Shared Responsibilities¶
- Sizing and performance tuning
- Security review
- Go-live validation
- Incident triage across product, cloud, database, and replication layers
- Upgrade planning
Decision Record Template¶
Capture these decisions before production go-live:
| Decision | Selected value | Owner | Approval date |
|---|---|---|---|
| Cloud provider/region | |||
| Kubernetes platform | |||
| Sizing tier | Small / Medium / Large | ||
| PostgreSQL service | |||
| Temporal mode | Embedded / external / dedicated | ||
| Secret backend | AWS / Azure / GCP / Vault / Infisical | ||
| Identity provider | |||
| Network egress policy | |||
| Evidence retention | |||
| Backup/PITR target | |||
| RPO/RTO | |||
| SIEM/log export |