Design Employee Rewards

Problem Statement: Peer Recognition at Enterprise Scale

We are designing employee rewards and peer recognition (Bonusly / Motivosity / Nectar class). The interview hinge is whether recognition money behaves like social feed posts (eventually consistent, lossy) or like ledgered currency (strong invariants, auditable). Bonusly-style products treat points as internal scrip: every award is a double-entry transfer from a sender allowance to a recipient balance, never a mutable counter column.

Personas: IC gives kudos with company values tags; manager tops up team budgets and sees culture analytics; People Ops configures monthly point pools, redemption catalog, and anti-abuse rules; finance exports liability for unredeemed balances.

Core flows: compose recognition → policy check (self-gift blocked, dept boundaries, max points) → atomic ledger post → async feed projection + Slack/Teams card → optional redemption against Tremendous-style catalog webhooks.

Anchor SLOs for this section: award write P99 180ms; feed fanout lag P95 3s; ledger double-spend rate 0; redemption fulfillment 99.5%. State invariants aloud: ledger entries sum to zero per award; budgets cannot go negative; redemptions are idempotent on provider callback.

Problem Statement: Peer Recognition at Enterprise Scale — design checkpoint (understanding)

Operational note: track award write P99, feed projector lag, ledger reconcile drift, and redemption fulfillment rate as first-class SLOs during understanding discussions.

Problem Statement: Peer Recognition at Enterprise Scale — depth notes (understanding)

Persona lens 1: People Ops cares about liability reports; managers care about participation rate; ICs care about feed latency. Failure drill 1: if Award Command returns 503, mobile queues offline awards with client-side idempotency keys—server reconciles on reconnect. Observability 1: emit award_write_ms histogram, budget_violation counter, feed_projector_lag gauge, redemption_hold_age gauge. Sharding 1: tenant_id hash to 256 logical shards; enterprises above 20k seats may move to dedicated cell 1 with isolated Kafka topic. Compliance 1: export immutable audit objects nightly; legal hold flag prevents GDPR erase on implicated recognition_event rows.

Why interviewers care

Employee Rewards interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement: Peer Recognition at Enterprise Scale that proves you understand real outages, not happy-path diagrams.