LogsF-2294

Entitlement mismatch — AWG reports ACTIVE, client rejects the handshake

SLA breached by408m 00sof 60m 00s

Entitlement mismatch rate

0.41%

from 0.02% · +20.5×

Affected users

412

Nexo Bank MX · status ACTIVE · error MFT-401

Cancels at risk

210

Modelled over 30 days

Detected

7h 48m ago

28 Aug 06:32 UTC

Attributable to

AWG

Commercial integrity. Entitlement, payment, subscription lifecycle, invoicing.

Past acknowledgement target — 60m, raised 7h 48m ago, recorded against AWG — platform

Routing & discussion

1 routed

M. Ferreirarouted7h 0m ago
412 ACTIVE Nexo Bank MX subscriptions rejected at the entitlement handshake
AWG — platform · no external reference

Destination

No agreed intakeNo agreed intake. Tickets go to a named individual and are not tracked by AWG. The ticket will be recorded here with no external reference to quote back.

SubjectBody

Evidence attached

AWG state vs. observed client behaviour (3 rows)
Support contact among affected users (2 rows)

Editable before send

Description

412 Nexo Bank MX users hold an ACTIVE subscription in AWG and are being billed, but the client returns MFT-401 on the entitlement handshake and no playback is possible. This is only visible with the join: AWG shows a healthy subscription, NPAW shows repeated failed play attempts, and Zendesk shows 89 of the 412 have complained. The remaining 323 have not contacted support at all.

Suggested action

Replay the entitlement handshake for the 412 affected AUMS UUIDs against the AWG staging endpoint and compare the returned product_id against dim_product.

Related logs

3 signals · expand a row for the event data

2026-08-28T06:32:00.000ZS-8822 THRESHOLD RULE Entitlement mismatch rate — observed 0.41%, expected 0.02%+20.5×

Detected: 28 Aug 06:32 UTC7h 48m ago
Detector: Threshold rule
Slice: Nexo Bank MX
Confidence: 98%
Affected users: 412
Observed: 0.41%
Expected: 0.02%
Deviation: +20.5×

Event dataAWGGET /awg/v2/entitlements200930mss-8822-0069a

{
  "timestamp": "2026-08-28T06:32:00.000Z",
  "endpoint": "GET /awg/v2/entitlements",
  "requestId": "s-8822-0069a",
  "status": 200,
  "latencyMs": 930,
  "request": {
    "metric": "Entitlement mismatch rate",
    "slice": "Nexo Bank MX",
    "detector": "rule",
    "window": "6h"
  },
  "response": {
    "observed": "0.41%",
    "expected": "0.02%",
    "deviation": "+20.5×",
    "confidence": 0.98,
    "affected_users": 412,
    "columns": [
      "AWG status",
      "users",
      "failed plays",
      "started"
    ],
    "rows": [
      [
        "ACTIVE",
        "412",
        "2,884",
        "0"
      ],
      [
        "TRIAL",
        "0",
        "0",
        "0"
      ],
      [
        "SUSPENDED",
        "18",
        "94",
        "0"
      ]
    ]
  }
}

Query

SELECT u.status, count(*) AS users, sum(p.startup_failed) AS failed_plays, sum(p.plays_started) AS started
FROM semantic.user u JOIN semantic.playback p USING (aums_uuid)
WHERE u.tenant_id = 'nexo-mx' AND p.error_code = 'MFT-401'
  AND p.day >= now() - interval '24 hours'
GROUP BY u.status

2026-08-28T06:38:00.000ZS-8824 NOVELTY DETECTION MFT-401 error volume — observed 2,884 events, expected 38 events+75.9×

Detected: 28 Aug 06:38 UTC7h 42m ago
Detector: Novelty detection
Slice: Nexo Bank MX
Confidence: 99%
Affected users: 412
Observed: 2,884 events
Expected: 38 events
Deviation: +75.9×

Event dataNPAWGET /npaw/v1/data/playback200932mss-8824-0069c

{
  "timestamp": "2026-08-28T06:38:00.000Z",
  "endpoint": "GET /npaw/v1/data/playback",
  "requestId": "s-8824-0069c",
  "status": 200,
  "latencyMs": 932,
  "request": {
    "metric": "MFT-401 error volume",
    "slice": "Nexo Bank MX",
    "detector": "novelty",
    "window": "6h"
  },
  "response": {
    "observed": "2,884 events",
    "expected": "38 events",
    "deviation": "+75.9×",
    "confidence": 0.99,
    "affected_users": 412
  }
}

2026-08-28T07:38:00.000ZS-8829 COHORT DECOMPOSITION Silent-suffering cohort — observed 323 users, expected —78.4% of affected

Detected: 28 Aug 07:38 UTC6h 42m ago
Detector: Cohort decomposition
Slice: Affected users with no ticket
Confidence: 95%
Affected users: 323
Observed: 323 users
Expected: —
Deviation: 78.4% of affected

Event dataZENDESKGET /api/v2/tickets/search200937mss-8829-006a1

{
  "timestamp": "2026-08-28T07:38:00.000Z",
  "endpoint": "GET /api/v2/tickets/search",
  "requestId": "s-8829-006a1",
  "status": 200,
  "latencyMs": 937,
  "request": {
    "metric": "Silent-suffering cohort",
    "slice": "Affected users with no ticket",
    "detector": "cohort",
    "window": "6h"
  },
  "response": {
    "observed": "323 users",
    "expected": "—",
    "deviation": "78.4% of affected",
    "confidence": 0.95,
    "affected_users": 323,
    "columns": [
      "raised a ticket",
      "users",
      "avg days affected"
    ],
    "rows": [
      [
        "yes",
        "89",
        "2.4"
      ],
      [
        "no",
        "323",
        "3.1"
      ]
    ]
  }
}

Query

SELECT has_ticket, count(*) AS users, avg(days_since_first_failure) AS avg_days
FROM semantic.user_ticket_coverage
WHERE finding_id = 'F-2294' GROUP BY has_ticket

Clustered support tickets

3 matched

Paid but says no subscription
ZD-48002 · Nexo Bank MX
7h 28m ago
Cannot watch anything
ZD-48031 · Nexo Bank MX
6h 20m ago
Error code MFT-401
ZD-48077 · Nexo Bank MX
3h 34m ago

Sample affected users

1c8f04ba2d40e7c938ab1f56