Admin & configuration

Payment policy, role & scope matrix, retention, and live integration health for OESC IT and operations staff. Every change here is recorded in the audit log (QTR.110) and requires the admin.config scope.

PAR.003 · parity extension

Integration health

Real-time

State-approved payment processor

Real-time card capture and ACH origination gateway

healthy

Latency

122 ms

Success

99.94%

Last check

May 7, 2026, 5:29 PM CDT

COBOL mainframe (balances)

Read tax / surtax / interest / penalty / fee balances

healthy

Latency

480 ms

Success

99.71%

Last check

May 7, 2026, 5:29 PM CDT

COBOL mainframe (end-of-day post)

Write end-of-day balance updates after capture

degraded

Latency

1810 ms

Success

96.40%

Last check

May 7, 2026, 5:25 PM CDT

Two failed posts in last 24 hours queued for staff retry. See reconciliation queue.

Identity provider (Entra ID + B2C)

Single sign-on for employers, TPAs, and OESC staff

healthy

Latency

95 ms

Success

99.99%

Last check

May 7, 2026, 5:29 PM CDT

Audit / log store

Immutable append-only audit and error log

healthy

Latency

38 ms

Success

100.00%

Last check

May 7, 2026, 5:29 PM CDT

ICESA / NASWA file ingest

Batch upload pipeline for TPAs

healthy

Latency

220 ms

Success

99.55%

Last check

May 7, 2026, 5:28 PM CDT

Payment priority order

PAY.003

Step	Category	Notes
1	Interest	Accrued statutory interest on delinquent quarters.
2	Penalty	Late-filing or late-payment penalty assessments.
3	Fee	Collection / handling fees applied to the account.
4	Tax	Base unemployment insurance tax obligation.
5	Surtax	Trust-fund stabilization surtax (rate-class dependent).

Order applies to excess payments and to payments without a selected quarter, walking from the earliest delinquent quarter forward.

Card processing fee

PAY.016

Current rate

2.65%

Applied at line item to credit and debit cards.

Fee floor

$0.50

Minimum applied to small card payments.

Net to OESC

100%

Card fees do not reduce the agency's collected amount.

The processor fee percentage is configurable per accepted brand. Changes requireadmin.configand route through change-management with an audit entry tagged config.payment.fee_change.

Accepted & blocked payment methods

PAY.004 / PAY.005

Method	Accepted?	Fee handling	Notes
ACH Debit	Accepted	No fee · 2 business day settlement	Default for employers and TPAs.
Credit Card (Visa/MC/Discover/Amex)	Accepted	2.65% processor fee added at line item	PAY.016.
Debit Card	Accepted	2.65% processor fee added at line item	PAY.016.
ACH Credit (NASWA/ICESA batch)	Accepted	No fee	TPAs only; PAY.011/PAY.012.
Wire transfer	Blocked	—	Blocked at API layer (PAY.005).
Foreign electronic payment	Blocked	—	Blocked (PAY.005).
Cryptocurrency	Blocked	—	Blocked (PAY.005).
Paper check / lockbox	Accepted	Logged via manual entry	Recorded after mainframe receipt; flagged 'Manual'.

Role & scope matrix

RBAC enforced on every endpoint

Role	employer.read	employer.read.full	payment.read	payment.write	payment.void	audit.read	settlement.read	settlement.resolve	admin.config
Read-only auditor Compliance staff. Read access only; cannot modify or post payments.
Tax payment processor Day-to-day OESC tax staff handling payments and reconciliation.
Supervisor Supervisors of OESC tax staff. Full operational rights, no system config.
Treasurer Coordinates with State Treasurer for settlement, refunds, manual ACH credits.
Admin OESC IT staff — manages roles, payment policy, and integration credentials.

Scopes are evaluated at the API gateway. Denied requests produce a structured audit row tagged QTR.111 with the user, IP, and requested scope.

Data retention & lifecycle

QTR.112

Data class	Minimum retention	Notes
Audit log	≥ 3 years	QTR.112. Cold storage tier after 90 days.
Payment transactions	7 years	Per Oklahoma retention schedule for financial records.
Receipts (PDF)	3 years	Generated on demand; persisted for 3 years.
ICESA batch files	5 years	Original files + parsed records.
Reconciliation queue	5 years	Resolved exceptions retained with full history.

Change-management workflow

Each config change generates a ticket: requester, justification, before/after diff, approver. Applied only after approval; reverts available for 30 days.

Secrets & credentials

Processor API keys and mainframe MQ credentials live in AWS Secrets Manager with quarterly rotation. Admin UI never shows secret values.

Backups & DR

Hourly snapshot of payment store; daily full backup; monthly restore drill. RTO 4h / RPO 24h. Cross-region warm standby.

Read-only in this prototype. The admin/config center is a parity preview — every value above reflects the OESC ESOW4 design intent. In production, edits would write through change-management and an audit trail before taking effect.