Mediation

Mediation covers everything the platform does between receiving a call and passing it on to the service: routing, transforming, composing, protecting. It is the pillar that makes the platform useful day to day, and the one through which business logic migrates out of the services if no limit is set.

The scope

Routing. A stable public path in front of an implementation that changes address, version or technology. The same point of indirection serves progressive migrations, see internal and external.

Transformation. Adapting a format, renaming fields, normalising dates. Useful for absorbing a legacy system, costly when it becomes the norm.

Composition. One call that triggers several. Mechanical, it stays a policy. As soon as it decides, default value, differentiated handling of failures, it becomes a service.

Protection. Rate limiting, quotas, timeouts, retries, circuit breaker: what stops one consumer penalising another and an outage spreading. The mechanisms and their settings are in resilience.

The limit

A transformation belongs in the platform when it is mechanical and reversible. It no longer belongs there as soon as it holds a decision the business might want to change.

The criterion fits in one question: if this rule changes, who has to be told? If the answer is the business, the rule belongs in a service, with tests and an owner.

Why the limit gives way

Changing a gateway policy takes an hour, changing the service takes a delivery cycle. Under time pressure, the trade-off always goes the same way, and it is made again at every emergency. A few years later the platform holds dozens of rules with no tests and no owner, written in a policy language the business teams do not read.

The counter-measure is procedural: every policy that holds a business value goes through review and carries the name of whoever asked for it. The inventory of these policies is an audit deliverable in its own right.

The protections, precisely

Rate limiting protects capacity over a short window. It does not protect against misuse: a consumer looping below the threshold gets through.

Quotas share the resource out over a long period. Setting each party's share is a decision about the offering, not a technical setting, even if it is expressed in the configuration.

Retries are only worth it on idempotent operations. Applied to a creation, they manufacture duplicates whose symptom shows up weeks later in the data.

Timeouts are set from the outside in: each tier waits a little less time than its caller, otherwise the waits stack up instead of failing cleanly.

Traffic to language models adds a special case: there, the cost of a call does not depend on the number of calls but on the volume of tokens consumed. Quotas then have to be counted in tokens, and attributing the cost per consuming team becomes a platform function, and the leading gateways on the market now provide it.

Crossing a protocol

Exposing a message queue as REST, a SOAP service as JSON, an event stream as a queryable API: these crossings fall under mediation and share one trap. They change the semantics at the same time as the format. A queue's delivery guarantee depends on the broker and its configuration, from at-most-once to exactly-once. The REST API placed in front exposes only one of them, often the most flattering, and the gap is paid for in duplicates at the consumer.

When the semantics change, mediation has to expose that rather than hide it: an idempotency identifier in the contract costs one line and avoids the entire class of defects.