Responsibility map
Shared power bank operations cross several systems. An integration plan should name the owner and evidence source for each one.
| Boundary | Core responsibility | Evidence |
|---|---|---|
| Station and firmware | Observe slots, power banks and local outcomes | Versioned device events and compatibility record |
| Device integration | Authenticate approved stations, validate messages and normalize events | Connection audit, parser result and profile version |
| Rental service | Own rental state, idempotency and reconciliation | State history and correlation identifiers |
| Renter experience | Guide scan, consent, payment, release, return and support | UAT result by market and release |
| Payment provider | Authorize, capture, refund and report provider state | Provider references and callback evidence |
| Operator dashboard | Present role-appropriate status and action history | Field source, freshness and role acceptance |
| Support workflow | Review mismatches and record authorized resolution | Reason, owner, action and timestamp |
Channel availability
| User | Primary channel | Optional channel | Boundary |
|---|---|---|---|
| Renter | Browser H5 with approved camera and QR scanning flow | Apple or Google app | App availability depends on store, account, region and review approval |
| Operator | Desktop web and approved mobile H5 workflows | Operator app | Exact mobile pages and app distribution require project confirmation |
| Agent or merchant | Role-scoped web access | Project-specific mobile access | RBAC defines visible tenants, stations, orders, reports and actions |
Channel presence does not prove payment-provider approval, camera permission, app-store availability or production readiness. Each is accepted separately.
Contract boundaries
Hardware protocol
Defines device-facing observations and approved coordination semantics. It does not grant production access or establish a payment result.
Platform API
Defines partner-facing business resources and events. It does not expose direct privileged device control through the public contract.
Payment integration
Depends on provider approval, merchant account state, regional payment methods and refund rules. A platform feature page is not provider confirmation.
Dashboard
Presents derived operating information. Every critical field should identify its source, freshness, role visibility and exception action.
Data minimization
- Use stable internal references instead of exposing raw hardware or provider identifiers.
- Remove credentials and operational endpoints from logs and support exports.
- Separate renter personal data from device telemetry.
- Define retention and deletion by data class and market.
- Use synthetic fixtures in public documentation.