> ## Documentation Index
> Fetch the complete documentation index at: https://altostrat.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Subscriber data-usage dispute: RADIUS evidence to credit note

> A subscriber disputes their data-usage bill. Pull the RADIUS accounting records, cross-check NetFlow, present the evidence, make the right call, and issue a credit note cleanly.

A subscriber claims their 400 GB bill is wrong — they insist their household used "a fraction" of that. The ISP needs to pull RADIUS accounting, cross-check against NetFlow, present the subscriber with evidence, and — when the facts warrant it — issue a credit note without drama.

## Systems involved

| System                              | Role                                        |
| ----------------------------------- | ------------------------------------------- |
| Kayako / Freshdesk                  | Ticket from the disputing subscriber.       |
| FreeRADIUS / Radiator               | Accounting records with start, stop, bytes. |
| NetFlow / IPFIX collector           | Per-flow detail for the subscriber session. |
| Splynx / Sonar                      | Subscriber record, service tier, data cap.  |
| Billing connector (Splynx / Stripe) | Credit note issuance.                       |
| Gmail                               | Subscriber-facing evidence and resolution.  |
| Studio artifacts                    | Evidence PDF attached to the resolution.    |

## Walkthrough

<Steps>
  <Step title="Ack the ticket">
    Copilot pulls the ticket text, the subscriber account ID, the disputed period, and the bill line items.
  </Step>

  <Step title="Pull RADIUS accounting for the period">
    Query the RADIUS accounting database for the subscriber's username. Aggregate Acct-Input-Octets and Acct-Output-Octets by day across the month. Export to a table artifact.
  </Step>

  <Step title="Cross-check with NetFlow">
    Pull the NetFlow records for the subscriber's assigned IP range across the same period. The totals match within 1.2 percent — not a counter-rollover issue, not a double-count.
  </Step>

  <Step title="Find the anomaly">
    Two days stand out: 87 GB on one Tuesday evening, 124 GB on one Saturday morning. NetFlow shows both hitting a popular streaming CDN and a backup service destination. The pattern is real usage, not a counter bug.
  </Step>

  <Step title="Check for service issues">
    Copilot validates there was no session hijack, no flapping session, and no double-count from a duplicate NAS entry. RADIUS shows a single session per day with normal accounting intervals.
  </Step>

  <Step title="Present the evidence">
    Generate a Markdown evidence artifact: daily totals table, the two anomaly days, top destinations for those days (provider only — redacted for privacy), the service cap, the overage calculation. Rendered to PDF.
  </Step>

  <Step title="Draft the reply">
    Copilot drafts the subscriber email through Gmail: we investigated, here's the evidence, here's what actually used the data, here's what we're willing to do about it — a one-time courtesy credit of the overage on condition of moving to a higher tier. Reviewed by a supervisor before send.
  </Step>

  <Step title="Issue the credit">
    If the subscriber agrees, the billing connector issues the credit note and the tier change. The ticket closes with the evidence PDF and the credit-note number attached.
  </Step>
</Steps>

## Where Studio earns its keep

* The evidence is sourced twice — RADIUS and NetFlow — so the conversation is about the facts, not about whether our logs are trustworthy.
* The anomaly days come out of the data in a sentence, which is easier to discuss than a spreadsheet of bytes.
* The billing action and the customer email reference the same evidence PDF, so the paper trail is one click long.
* The same evidence template is reusable for every future dispute — and the procedure that produced it is saved for next time.

## Related

<CardGroup cols={2}>
  <Card title="Files and artifacts" icon="file" href="../../files-and-artifacts" arrow="true" cta="Use evidence">
    Generate the subscriber-facing evidence PDF inline in the workspace.
  </Card>

  <Card title="Procedures" icon="workflow" href="../../procedures" arrow="true" cta="Reuse">
    Save `Data usage dispute evidence` as a parameterized runbook.
  </Card>
</CardGroup>