Revenue-account configuration is a financial control

What the public implementation shows

The gateway models RevenueAccount and exposes dedicated configuration-admin endpoints for active default combinations of MDA, service, currency, and account.

Revenue authorities create bills only within combinations configured by an authorized portal user. This is the implementation fact behind the note; the architectural reading begins from that visible boundary rather than from an assumed production story.

Operating principleConfiguration decides where public money may go, so it belongs inside the financial control model.

The decision behind the mechanism

The destination is resolved from governed configuration instead of trusting each inbound invoice to supply an arbitrary creditor account.

If every bill can choose its own destination, a compromised authority client or mapping error can redirect public funds. The mechanism matters because it gives that failure a named boundary, durable evidence, and a controlled response instead of leaving the outcome to timing or operator guesswork.

• Require a configuration-admin role for writes.
• Enforce one active default for a governed combination.
• Reject bills without a matching active configuration.
• Audit changes before they affect payable obligations.

How the control should be operated

Configuration changes should record actor, previous value, activation state, default selection, review evidence, and effective time.

Bill creation and payment confirmation share one controlled routing authority. The reusable lesson is not to copy a class or endpoint in isolation, but to preserve the relationship between identity, state, authority, evidence, and operational ownership.