Design a backend boundary where subscription plans control which product features an account can use.

In production I would add a periodic reconciliation job with the billing provider, alerts for webhook failures, and a cached entitlement read model with fast invalidation. Access checks should fail closed or degraded based on product risk; for example, read access may continue during provider outage while privileged write actions are blocked. I would record why access was denied so support can distinguish plan limits from stale billing state. I would also define plan migration behavior for existing customers, audit entitlement overrides, and monitor entitlement mismatches, webhook lag, failed checks, override usage, and migration errors.