How American Express contains payment failures without sharing in-flight state

ByteByteGo's interview with American Express engineer Ben Cane explains a payment architecture organized around independent failure domains. Each cell contains the services and data needed for a real-time transaction; a deliberately thin router handles boundaries. The central tradeoff is to repeat short, recoverable work rather than couple healthy cells to a failing cell's partial state. Recovery still depends on payment-specific rules, including irreversible steps and duplicate suppression.




