Suggested pattern (resilient)
- Define event schema + ownership.
- Write an audit log at the source.
- Retry with idempotency keys.
- Manual queue on failure.
- PII: minimize fields + redact logs.
Fallback options
- CSV bridge with validation
- Webhook fan-out (if available)
- Nightly sync (if eventual consistency is OK)