# 11 — Risks, Blocked Items & Open Questions

## 1. Externally blocked / configurable integrations

| Item | Status | What unblocks it | Owner | Lead time (typical, varies) |
|------|--------|------------------|-------|-----------------------------|
| Meta app (Facebook Pages, Instagram, Threads) | `blocked` | Business Verification + App Review for each permission, privacy policy, data-deletion callback, screencasts on staging | WhizzAct (business) + dev | 2–6 weeks, may need resubmission |
| LinkedIn org posting & analytics | `blocked` | Community Management API application approval | Business | Weeks; not guaranteed |
| LinkedIn member posting | `configurable` | Self-serve "Share on LinkedIn" product on the app | Dev | Days |
| YouTube uploads (public) | `configurable` | Google OAuth verification (sensitive scopes) + YouTube API audit for public uploads/quota increase | Business + dev | 2–8 weeks |
| X posting | `blocked` | **Business decision on paid API tier / pay-per-use budget** | Business | Immediate once paid |
| TikTok Direct Post | `blocked` | Content Posting API audit (until then, private-only posts) | Business + dev | Weeks |
| Pinterest | `configurable` | Upgrade from trial to standard access | Dev | 1–3 weeks |
| Google Business Profile | `blocked` | GBP API access request approval + verified locations | Business | Weeks |
| Razorpay live mode | `configurable` | KYC/business activation, subscription product enabled | Business | Days–weeks |
| Anthropic API | `configurable` | Org API key + spend limits | Business | Immediate |

**Recommendation:** start the Meta, Google, LinkedIn, and TikTok submissions **during M1**, because they need a public staging URL, privacy policy, and terms. Prepare those early.

## 2. Open questions (need a decision)

| # | Question | Default assumed in plan | Needed by |
|---|----------|-------------------------|-----------|
| Q1 | Product name and root domain? | `SocialHub` / `example.com` placeholders | M1 (branding), M2 (OAuth app registration) |
| Q2 | Hosting: AWS `ap-south-1`, or another provider? | AWS Mumbai | M1 (infra-as-code start) |
| Q3 | Payment gateway: Razorpay only, or also Stripe for international? | Razorpay first | M6 (but affects plan/price schema in M1 seeding) |
| Q4 | Can an agency user belong to multiple agencies (freelancers)? | Yes, via an agency switcher | M1 |
| Q5 | Can client users connect their own social accounts? | Yes, if the agency enables it per client | M2 |
| Q6 | Starting set of providers for launch (given approvals)? | Build all adapters. Launch with whichever are approved | M2 |
| Q7 | X API budget (tier) acceptable? | Not purchased → X `blocked` | M2 |
| Q8 | Data residency: must all data stay in India? | Yes (ap-south-1) | M1 |
| Q9 | Report PDF engine: headless Chrome (Browsershot, higher fidelity, heavier) vs DomPDF? | Spike in M5 | M5 |
| Q10 | Enterprise: dedicated DB host per tenant needed? | Supported via `tenant_database_connections.host`, not default | M6 |
| Q11 | Free trial length and whether a card is required? | 14 days, no card | M1 (trial row), M6 |
| Q12 | GST: seller GSTIN and state for invoicing? | TBD | M6 |
| Q14 | Which unimplemented publish formats matter most (LinkedIn video, X video, Pinterest video, Facebook Reels, TikTok photos)? | Implement on demand | M4–M6 |
| Q15 | Production object store and CDN for provider media pulls (S3 + CloudFront?) and TikTok domain verification | S3 pre-signed URLs | Before launch |
| Q13 | Should the platform flag (or block) the same Page/profile being connected by two different agencies? Needs a central index of external account ids. | **Flagged, not blocked** (31 Oct 2026): master `account_routes` is the index; a second agency connecting the same account raises `social_account.shared_across_tenants` in the admin audit log and lists it under Admin → Operations. Agencies are not told about each other. Decide whether to block. | M3 |

## 3. Technical risks

| Risk | Impact | Mitigation |
|------|--------|-----------|
| MySQL connection exhaustion with many tenant DBs | Outages under load | Lazy connect + purge, RDS Proxy, bounded worker concurrency, connection metrics |
| Tenant migration drift (some tenants fail mid-deploy) | Inconsistent schema | Expand/contract migrations, `schema_version` per tenant, batched `tenants:migrate` with resume, migrations backward-compatible for one release |
| Duplicate posts on ambiguous timeouts | Brand damage | `unknown_outcome` + reconciliation, never blind retry (doc 06) |
| Provider API changes and deprecations (Graph version sunsets, LinkedIn version headers) | Broken publishing | Version pinned in config, deprecation calendar, contract tests, capability versioning |
| Context leakage in long-running workers | Cross-tenant data exposure (critical) | `finally` purge + Queue hooks + arch tests + leak assertions in every test |
| Instagram requires a publicly fetchable media URL | Upload failures with short-lived URLs | Per-provider signed URL TTL (e.g. 1 h), CloudFront signed URLs |
| YouTube quota exhaustion | Uploads deferred | Quota budget tracking + warnings + quota increase request |
| Large video processing cost | Infra cost | Transcode only when needed, meter video minutes per plan |
| Scope creep (spec is full product) | Schedule slip | Strict milestone gates and acceptance criteria. Feature flags for partial features |
| Livewire v4 maturity for complex composer UI | UX/perf issues | Spike the composer in early M3. Alpine for client-side preview. Fall back to small Alpine islands where needed |

## 4. Compliance notes

- **DPDPA 2023 (India):** privacy notice, consent records, purpose limitation, data principal rights (export/delete), breach notification process, processor agreements (AWS, Sentry, Anthropic). Review with counsel before launch.
- **Platform policies:** Meta Platform Terms, LinkedIn API Terms, YouTube API Services Terms (including the requirement to link to Google's privacy policy and allow revocation), TikTok developer terms (UX requirements), X developer agreement. Each provider's data retention/deletion rules feed into the retention jobs.
- **Never:** scrape, automate browser sessions, store social passwords, or bypass rate limits or review.