One System, Not Two
Instead of handling billing and authorization as separate concerns, this architecture treats payment as part of the platform control path.
Platform Architecture
Entitlement-Driven Platform Architecture
Connecting identity, billing, and access control as one governed platform flow.
“I stopped treating billing and access control as separate systems. I designed them as one.”
This page documents how JLT-Lane connects Clerk identity, Stripe checkout, webhook automation, role metadata, and RBAC enforcement into one clear system model.
Architecture Diagram
The entitlement flow spans three platform planes: execution, operations, and control. The execution plane captures user and payment actions, the operations plane processes webhook automation and synchronization, and the control plane maps entitlements to access decisions enforced across the platform.
“I stopped treating billing and access control as separate systems. I designed them as one.”
Core Flow
At a high level, the system turns a payment event into an access-control event.
- Signed-in Clerk user starts checkout
- Stripe creates the checkout session and carries identity-linked metadata
- Stripe webhook receives the event and validates it
- Membership state and entitlement data are updated
- Clerk user role metadata is synchronized
- RBAC guards evaluate permissions
- Role-aware UI and protected routes update automatically
Why It Matters
Faster Access Changes
When the payment state changes, the platform can update roles and access automatically without manual provisioning.
Governed Access Control
Entitlements are enforced through role metadata and RBAC guards, making platform access structured, auditable, and easier to reason about.
Plane-by-Plane Breakdown
Execution Plane
User & Payment Flow
The execution plane captures the user-facing flow. A signed-in Clerk user begins checkout, Stripe creates a secure checkout session, and the platform associates the payment action with user identity.
- Signed-in user context
- Stripe checkout session creation
- Role-aware UI behavior
- Protected page and route entry points
Operations Plane
Automation & Sync
The operations plane receives and processes Stripe events. It persists membership and entitlement state, then synchronizes user role changes back into the identity layer.
- Webhook validation and event handling
- Membership persistence
- Role synchronization
- Automated entitlement updates
Control Plane
Identity & Authorization
The control plane holds the identity and authorization model. Clerk remains the source of truth for users, role metadata maps plans to permissions, and RBAC guards enforce access across the platform.
- Clerk identity context
- Role metadata mapping
- RBAC enforcement
- Protected resources and route access
Design Principles
Identity-Linked Billing
Payment actions are associated with user identity early in the flow so downstream systems can update the correct account with confidence.
Metadata-Driven Entitlements
Plan and role information flows through controlled metadata rather than manual after-the-fact access changes.
Automatic Access Enforcement
The platform responds to entitlement changes through role-aware UI behavior and protected route enforcement.
Closing Note
This architecture reflects a platform mindset: identity, payment, automation, and authorization should not behave like disconnected systems. They should work together as one governed flow that is easier to operate, secure, and scale.
In this model, billing is not only a financial event. It is also a platform control event that directly shapes user access.