Principal Architect - Broker Connectivity & Token Resilience Platform

Build an architecture for the Broker Connectivity & Token Resilience Platform Multi-user • Multi-brokerage • Multi-account • Multi-data-center Executive summary The company connects users and managed accounts to multiple brokerages. Each authorized brokerage connection may expose one or more brokerage accounts and may use different authentication mechanisms, expiration periods, rotation rules, rate limits, IP restrictions, and recovery procedures. The current refresh process must not depend on a single application process or data center remaining available. Architecture principle: The platform is active-active across regions at the service level, but active-passive for each brokerage connection. At any moment, only one fenced owner may refresh and update a particular connection. # Business outcome • Users remain connected to their brokerages through ordinary system deployments, application outages, server failures, and availability-zone failures. • A user may authorize multiple brokerages and multiple logins at the same brokerage without one connection blocking another. • One authorized login may expose multiple brokerage accounts without duplicating token state unnecessarily. • Trading services obtain a valid token through one controlled interface and never read or refresh token data directly. • Operations can identify broker-wide failures, connection-specific failures, expiring credentials, and reauthorization needs before they affect trading.