Entitlement

You have had this bug. It does not have a good name, which is most of why it keeps happening.

The customer paid.        Payments says active.    Your app says no.
The card failed Tuesday.  Payments says past_due.  Your app said yes till Friday.
Support granted credit.   Payments knows nothing.  Which system is right?

Each of those is the same failure wearing different clothes: two systems hold part of the answer to one question, and nothing owns the whole of it. Auth knows who someone is. Billing knows what they paid. Neither knows what they are allowed to do right now, so every product ends up growing a third thing in application code — a helper, a boolean on the user row, a cache that goes stale on a Tuesday.

That third thing is the object you never named. Here it is called an entitlement, and it is the product.

One customer, one answer

An entitlement is the computed answer to what may this person do, resolved at the moment you ask, from every input that has a claim on it. Not a column. Not a webhook that fired last week. A resolution, run when the question is asked.

can(customer, "seats")  →  150   from plan:pro
                                 +50  from a support grant, expires Sep 1
                                 −0   no override
                                 ───
                                 200  effective

Three inputs, resolved in a fixed order, every step visible. The order is the whole mechanism and it never varies: plan → grant → override.

Why this is the layer and not a feature

Payments, auth, hosting and mail are commodities — real work, but work many companies do adequately. What almost nobody does is keep one coherent answer across all of them, which is why the bug at the top of this page is universal.

Lath provisions the services so that one thing can own the answer. The services are what it takes to have an entitlement worth resolving.

A consequence worth stating early, because it explains decisions you will meet later: entitlement is payment-source agnostic. A card, an invoice, a support grant and an app-store receipt all resolve into the same object. That is why a new payment source arrives as an adapter rather than a rewrite.

What to read next

The resolution ladder is the mechanism above, in detail — the three steps, what each can do, and what happens when one of them has nothing to say.