What a National Service Bus actually delivers — beyond the diagram
We built the national interoperability platform for the Government of Moldova and contributed to comparable work in Ukraine. The platform was delivered and tested against acceptance criteria of 99.9% availability and 250 async messages per second. Here is what was inside the diagram — and what was harder than the diagram.
Building blocks that exist on day one
Service Bus (ESB) for routing and mediation. Service Registry with systems catalogue and metadata. Semantic Catalogue for common data definitions. BPM + Business Rules Engine for processes and validation. Platform services: logging, monitoring, centralized authentication. None of this was "discovered at implementation" — all of it was a day-one requirement.
Identity federation via M-Pass
M-Pass (Moldova) as national IdP, linked to service consumers and service providers. Claim mapping over institutional attributes — role, institution, privileges. Single sign-on for the citizen, signed identity assertions for the system. The same pattern was replicated for the Ukraine contribution.
PKI on inter-institutional messages
Digital signature on every message exchanged between institutions. Ingress verification. Non-repudiation — institution A cannot deny what it sent, institution B cannot deny what it received. Independently auditable, without internal databases.
Service governance
Contract-first: WSDL for SOAP, OpenAPI for REST. Semantic versioning — a breaking change is an event, not an accident. Artifact dependency graph — before retiring a service, you know exactly who consumes it.
Load targets that dictated the architecture
More than 300 information systems. Average 200 messages per system per day. High-end systems — 50,000 messages per day. 250 async messages per second. Not all systems the same; the architecture was sized for the real peak, not the theoretical average.
Operational handover
We didn't deliver and leave. Operational runbook. Training for the agency team. 5+ concurrent administrators, because one person's absence must not block operation. Knowledge transfer measured in months, not days.
What the slides don't say
Migrating legacy systems was 60% of total effort. Building the platform — 40%. The diagram is easy; calling the vendor of a 2004 system to explain why it has to accept a new certificate — that's hard.