Compose Hybrid Spec
Pick features from multiple specs and mix them into a single build. Notifications from Slack + payments from e-commerce? Go.
Source specs
Interface Type*
Capabilities*
Tradeoffs
Faster to set up but customization hits a ceiling quickly; often needs to be replaced
Requires a flag evaluation layer in every feature; adds latency if not cached
Every admin action must be explicitly logged; easy to miss if not enforced at the framework level
Tracking Scope*
Analytics Provider*
Tradeoffs
User data is shared with vendor; may require GDPR consent flow
Significant storage cost; must redact sensitive fields (passwords, PII)
Full data ownership and unlimited retention, but requires infrastructure expertise
What to Log*
Storage Backend*
User-facing Surface
Tradeoffs
Read amplification — every authenticated read produces a log write
Two storage systems to operate and keep in sync; queries may need to federate
Tamper-evidence relies on DB role permissions — insufficient for some compliance regimes
Queue Backend*
Required Capabilities*
Failure & Durability*
Tradeoffs
Primary DB absorbs queue write load; row-level locks contend with application queries
Enqueue happens outside DB transaction — jobs can run for state that was rolled back
Additional table, polling worker, and idempotency discipline — the payoff is no duplicated side effects
Delivery Method*
User Control
Tradeoffs
Requires persistent connection infrastructure (e.g. Redis pub/sub, WebSocket server)
Higher server request volume; notifications may lag by poll interval
Requires APNs/FCM credentials and certificate management
Significantly more complex preference storage and UI
Billing Model*
Payment Processor*
Tradeoffs
Requires handling trial periods, dunning, proration, and cancellation flows
Must instrument every billable action and send metered events to billing provider
Less customizable checkout; Paddle acts as legal seller so you avoid VAT registration
API Type*
API Authentication*
Webhooks
Tradeoffs
Powerful for clients but requires schema design discipline; N+1 queries are a common pitfall
Enables third-party integrations but requires an authorization server and token management
Event ordering, deduplication, and retry logic become your responsibility
Rate Limit Algorithm*
What to Limit By*
Abuse Prevention Layer
Response Behavior*
Tradeoffs
False positives behind corporate NATs; attackers bypass with rotating proxies
Noisy-neighbor protection — one tenant cannot starve others
Allows bursts but requires a per-identity bucket state in Redis — higher memory footprint
Meaningful latency cost at the edge if the WAF is geographically distant from users
Delivery Provider*
Deliverability Setup*
Templating Approach*
Tradeoffs
Vendor cost scales with volume; deliverability expertise comes included
Low per-email cost but you own deliverability operations (reputation, bounces, suppression)
Two sending configurations and domains to maintain — worth it for deliverability isolation
Authentication Methods*
Access Control*
Multi-factor Authentication
Tradeoffs
Each provider requires an OAuth app registration and key rotation policy
Requires IdP partnership and XML-based protocol handling; significant integration work
Permission checks must be applied consistently across every data access path
Delivery Guarantees*
Payload Security*
Customer Visibility
Tradeoffs
One slow consumer blocks subsequent events for the same resource
High write volume to log storage — plan for hot shards if a customer has thousands of endpoints
Slight CPU cost per delivery; negligible compared to network I/O
Summary
11 of 11 composed features enabled
Pulled from 1 source spec
Effort Estimate
10+ weeks