CHAPTER 05Security & launch
Your protection plan
These are proposed protections for the product being designed. Implementation and testing evidence has not been recorded. Autolace and hosting-provider assurances are separate.
Planned · Evidence pendingAccess that follows responsibility
Enforce least privilege on the server, with stronger verification for privileged actions.
Requirements & success criteria
Owner: Build team. Build team: implement and attach verification evidence before release.
Planned · Evidence pendingInformation stays within its boundary
Keep each customer or organization’s records isolated, including exports, search and file access.
Requirements & success criteria
Owner: Build team. Build team: implement and attach verification evidence before release.
Planned · Evidence pendingProtected information and secrets
Use encryption in transit and appropriate encryption at rest. Keep secrets out of browsers, logs and exports.
Requirements & success criteria
Owner: Build team. Build team: implement and attach verification evidence before release.
Planned · Evidence pendingSecure sign-in and sessions
Use maintained identity services, secure cookies, revocation and appropriate reauthentication.
Requirements & success criteria
Owner: Build team. Build team: implement and attach verification evidence before release.
Planned · Evidence pendingA record of important changes
Record sensitive access and important changes with actor and time; restrict log access and avoid unnecessary sensitive content.
Requirements & success criteria
Owner: Build team. Build team: implement and attach verification evidence before release.
Planned · Evidence pendingA tested way to recover
Define backups, recovery targets and incident response appropriate to the product.
Requirements & success criteria
Owner: Build team. Operating team: agree recovery targets and incident ownership.
Planned · Evidence pendingCollect only what is needed
Limit sensitive data collection, define retention and deletion, and assess vendor data flows including AI.
Requirements & success criteria
Owner: Build team. Product owner: confirm material retention and data-use obligations.
Planned · Evidence pendingSecurity checks before release
Map relevant OWASP ASVS requirements to the build, review dependencies and address material findings before launch.
Requirements & success criteria
Owner: Build team. Build team: implement and attach verification evidence before release.
Who can do what
Coordinators
Can
- Assign jobs
- See the team queue
- Review change history
Cannot
- Change owner access without authorisation
Technicians
Can
- See assigned jobs
- Add updates and completion notes
Cannot
- Browse other technicians’ jobs
- Export the customer directory
Customers
Can
- View their own requests
- Confirm completion
Cannot
- View another customer’s information
- Assign technicians
Training & adoption
A useful first five minutes
Walk each technician through a clearly labelled practice update, then help them find their first real assignment.
Requirements & success criteria
Pilot, listen, improve
Start with two technicians and one coordinator. Collect feedback in the app and revise confusing steps before inviting everyone.
Requirements & success criteria