Implementing a marketplace seller tool through six reversible states

Marketplace seller software tool implementation should move through reversible states. The operating case is one fictional England merchant, authorised seller, named marketplace account and exact service moving an approved product record, stock position and later order states to and from the seller's source system.

No tool or live journey was tested. Research closed on 6 September 2026. Production remains disabled until every independent gate passes and the authorised owner approves a bounded release.

State 1: freeze the approved baseline

Record the current manual route, seller entity, account authority, product population, identifiers, stock unit and source records. Preserve the consumer-facing listing and open-order handling method. Write the rollback owner and conditions before changing anything.

Give every later state its own definition and evidence: placed, accepted, authorised, captured, fulfilled, cancelled, returned, partially refunded, disputed and settled. GOV.UK's online-selling page identifies product, price, ordering, correction and confirmation matters that consumer counsel should inspect for the actual offer.

State 2: approve the interface and evidence maps

Version the input and output schemas, identifiers, transformation rules, ordering, retries, rejection logic and change process. Give product facts, stock conflicts, price, optional choices, safety evidence, customer support and tax records separate owners.

Map personal-data purposes, sources, fields, recipients, roles, subprocessors, transfers, retention, rights routes and deletion. List device storage or access independently. The ICO's current controller and processor guidance makes the role question factual; a contract label alone does not answer it.

State 3: configure a restricted environment

Use least privilege and individual accounts. Disable production publishing, customer communication and payment. Limit support access, enable suitable logs and record who can approve a configuration change.

NCSC's SaaS security guidance covers authentication, privileges, monitoring, protected copies and recovery in the customer's configuration. It does not certify this service. Stop if account removal or evidence collection cannot be demonstrated.

State 4: run the fictional fixture

Predeclare the expected result for an approved and rejected product change, conflicting stock, corrected total price, an unselected optional extra, duplicate and late events, a rejected update, cancellation, partial refund, dispute, suppression and refused tracking. Add revoked privileged access, accessible staff and customer tasks, rollback, export and isolated restore.

Use fictional products and people. Send no public listing, real order, payment or customer message. Record expected input, observed output, timestamps, logs, reviewer and result. A pass covers only the tested behaviour and edition; it does not show marketplace-wide access, compliance, performance or future durability.

State 5: close each specialist gate

Consumer counsel reviews seller identity, price, optional choice, confirmation, cancellation and refund evidence. Product-safety counsel checks actual roles, territory, traceability and correction. OPSS business guidance retains the Great Britain and Northern Ireland distinction and warns that product-specific rules may apply.

Privacy and PECR reviewers decide the data and device questions. Security, accessibility, procurement, contract, accounting and VAT reviewers issue their own pass, rework, hold or stop result. A strong security result cannot offset a missing product record or inaccessible refund route.

State 6: rehearse failure and exit

Inject a duplicate event, unavailable connection, incorrect transformation and revoked credential. Confirm containment, preserved evidence, correction, rollback and named restart authority. Reconcile any fictional later order state with the source record rather than treating the tool's label as an accounting conclusion.

Export the required fields, restore them in isolation, remove access and obtain deletion evidence. NCSC supplier-assurance guidance specifically prompts buyers to investigate incident recovery and contract exit. If the current process cannot resume, the exit gate remains failed.

State 7: decide without pretending to launch

The final pack contains the baseline, exact edition, contract versions, evidence maps, fixture results, exceptions, specialist decisions and rollback record. The authorised owner may approve only the stated population and configuration after all gates pass. Any change to edition, marketplace interface, subprocessor, data purpose, product scope or commercial term reopens the affected reviews.

This is an implementation specification, not evidence of a completed deployment. The publication and production verdict remains hold until the named people review the real system and current sources.