# 05 · Open Questions & Assumptions

These are decisions the requirement does not settle. The prototype and schema use the assumption shown; each is a small, isolated change if the answer differs.

| # | Question | Assumption used | Where to change |
|---|---|---|---|
| 1 | What exactly is the **40:20** allocation? Which buckets, and where does the remaining 40% go? | 40% Restock Fund, 20% Repayment Fund, 40% remainder paid to the merchant | `allocation_rule_buckets` rows (data, not code) |
| 2 | Is allocation calculated on POS sales or on the amount actually received in the bank? | On the amount actually received (Matched or Partial settlements) | Allocation job |
| 3 | Is **expected settlement** equal to POS sales, or POS sales minus Fasspay MDR/fees? | Equal to POS sales | Settlement batch job (add `fee_rate` per merchant if needed) |
| 4 | Is there one settlement bank account for all merchants, or one per merchant? | One shared settlement account; `destination_account_id` supports per-merchant | `settlements.destination_account_id` |
| 5 | Should **Management** (Siti, Ng Zhiyan) also verify documents, verify reports and lock months? | No — Management has every right except verify and lock, which stay with Syafiqah and Asyraff as written | `is_full_access()` and the app permission map |
| 6 | Who records the ZUS location decision? | Full Access or Management | Permission map |
| 7 | Repayment due date and start | 10th of each month, starting the month after activation; 24 instalments of RM675 | `repayment_plans.first_due_date` per merchant |
| 8 | Does POS send one total per merchant per day, or several rows (per shift/terminal)? | One daily total | Drop `UNIQUE (merchant_id, sales_date)` on `sales` if several rows per day |
| 9 | Company login: Google Workspace or Microsoft 365 for `@asgb.com.my`? | Either; SSO provider is configurable | Auth configuration |
| 10 | Restock "ready" threshold | RM300 available | App setting |
| 11 | Public holidays to skip for the daily Finance report | Weekdays only until the holiday list is loaded | `public_holidays` table |
| 12 | Will applicants submit registration themselves (public form) or will Ops key it in? | Ops keys it in / imports CSV for MVP; a public form can post to the same `applications` table later with `source='api'` | Registration module |
| 13 | Retention period for documents and personal data (PDPA) | Keep for the agreement term + 7 years | Storage lifecycle policy |
| 14 | Who receives Finance emails (named list or a shared Finance mailbox)? | Finance role users | Notification routing |