Backlog and acceptance criteria

All MVP work is Must unless shown. Complexity is relative and includes product, engineering, security, testing and documentation.

MVP-01 — Tenant, entity and role onboarding · L

Problem/persona: tenant owner needs a safe accountable boundary. Legal/control: CTRL-GOV-001. Scope: tenant, one/many legal entities, OIDC, MFA, RBAC/ABAC, maker-checker, domain/contact tests, synthetic trial, go-live. Non-goals: customer CIAM and production SAML/SCIM in first slice. Dependencies: identity provider, tenancy/key/audit foundations.

UX: guided checklist with risk for skipped items. Data/API/events: Tenant, LegalEntity, RoleBinding, Approval; /tenants, /entities; tenant.activated.v1. Security/privacy: server-derived tenant, last-owner protection, break glass, no PII demo.

Acceptance: Given a user changes a resource tenant ID, when authorised for another tenant, then the API returns indistinguishable 404/403 policy response and no event/data leaks. Given go-live, when MFA or contact test fails, then approval is blocked.

Evidence/metrics/rollout: domain/role/access/approval log; time to safe setup and skipped critical controls; internal tenant → synthetic design partner → pilot migration.

MVP-02 — Applicability and obligation registry · L

Problem/persona: legal/privacy need source-linked entity/role decisions. Mapping: LEG-DPDP-001/003, CTRL-REG-001. Scope: sources, status, entity facts, role and one finance pack, configuration version/diff. Non-goals: autonomous legal advice. Dependencies: legal schema/reviewer workflow.

UX: fact form, evidence, uncertainty and impacted controls. Data/API/events: InstrumentVersion, ApplicabilityAssessment, Obligation; /obligations; legal_config.approved.v1. Security: signed bundles, author/reviewer separation.

Acceptance: Given a future-effective requirement, when viewed, then date/status is explicit and it cannot be shown “in force.” Given an unverified government API, then fields remain adapter placeholders.

Evidence/metrics/rollout: signed assessment/diff; high-risk activities with approved source; maintainer sandbox → customer legal review → signed activation.

MVP-03 — Purpose and notice versions · L

Problem/persona: data owner/privacy must prove why and what was told. Mapping: CTRL-PURPOSE-001, CTRL-NOTICE-001. Scope: consent/exact section 7 catalogue, itemised notice, review/publish/hash, English. Non-goals: generated legal copy and all languages. Dependencies: entity/control register.

UX: structured purpose/data/recipient binding and copy preview. Data/API/events: Purpose, NoticeVersion; /purposes, /notices; notice.published.v1. Security: immutable approved versions, sanitised content, no script.

Acceptance: Given “legitimate interest,” approval fails. Given a changed active notice, a new version/hash is created and historic receipts retain the old version.

Evidence/metrics/rollout: approval/hash/publication; active collection endpoints on approved version; synthetic channel → one pilot journey.

MVP-04 — Consent receipt and withdrawal · XL

Problem/persona: Principal/developer need provable choice and downstream stop. Mapping: CTRL-CONSENT-001/002, CTRL-PROPAGATION-001. Scope: grant/deny/withdraw API, receipt, preference read, signed generic webhook, reconciliation. Non-goals: cookie scanner/mobile/AA. Dependencies: MVP-03, event/outbox.

UX: comparable grant/withdrawal, immediate receipt, partial status. Data/API/events: ConsentReceipt, PropagationTask; /consents, /{id}/withdraw; consent.withdrawn.v1. Security: idempotency, replay, approved versions, no backdating mutation.

Acceptance: Given duplicate idempotency key/same body, same receipt returns; different body conflicts. Given one failed processor, withdrawal is partial and the successful actions remain.

Evidence/metrics/rollout: receipt hash/destination report; proof completeness and propagation latency; load test → shadow → limited production.

MVP-05 — Principal request and grievance portal · XL

Problem/persona: Principal/DPO need safe intake and fulfilment. Mapping: CTRL-RIGHTS-IDENTITY-001, CTRL-RIGHTS-001, CTRL-GRIEVANCE-001. Scope: mobile portal, existing-account/manual identity, exact request types, tasks, messages, response package. Non- goals: automatic refusal and full nomination activation. Dependencies: tenancy, connectors, messaging.

UX: plain choice/status, assisted route, secure delivery. Data/API/events: refs/matches/ requests/grievances/tasks/messages; /rights-requests, /grievances; rights_request.received.v1. Security: non-enumeration, step-up, attachment quarantine, maker-checker refusal/export.

Acceptance: Given connector failure, case remains fulfilment/partial and cannot auto-refuse. Given 320 px/keyboard/screen reader, critical journey passes documented accessibility tests.

Evidence/metrics/rollout: identity/case/task/delivery pack; time/partial/override, not volume; synthetic → employee volunteers → pilot customers.

MVP-06 — Retention, hold and manual deletion · L

Problem/persona: records/legal/system owner must reconcile erasure and preservation. Mapping: CTRL-RET-001, CTRL-HOLD-001, CTRL-DELETE-001. Scope: source-linked rules, holds, task orchestration, partial certificate and backup expiry. Non-goals: arbitrary automated SQL. Dependencies: inventory, tasks, evidence.

UX: conflict and destination view. Data/API/events: rules/holds/jobs/certificates; /retention-policies, /legal-holds, /deletion-jobs; deletion.verified.v1. Security: destructive maker-checker, stale-source block, audit.

Acceptance: Given active hold, disposal is blocked only for matching scope. Given ambiguous destination, complete certificate cannot issue. Given restore, tombstone re-deletes before release.

Evidence/metrics/rollout: rule/hold/destination/certificate; backlog/partial/hold age; synthetic record classes → one source system.

MVP-07 — Breach case and clocks · L

Problem/persona: commander/DPO need multi-regime operation under uncertainty. Mapping: CTRL-BREACH-001/002, CTRL-CERT-001. Scope: intake/timeline, DPDP/CERT-In/contract tests, clocks, templates, submission/delivery evidence. Non-goals: automatic legal decision or undocumented regulator API. Dependencies: legal config, notifications, audit.

UX: clock-first command view and offline pack. Data/API/events: incidents/assessments/ clocks/reports; /incidents; clock.triggered.v1. Security: awareness immutable, privileged notes, suppression alerts.

Acceptance: Given severity/owner changes, awareness/deadline remains. Given portal outage, attempt/fallback evidence is available. Given incomplete facts, initial version can be approved and updated.

Evidence/metrics/rollout: timeline/decision/report/receipt; time to acknowledgement/decision/ submission; tabletop → parallel existing IR → pilot.

MVP-08 — Processor and vendor register · M

Problem/persona: processor manager needs instruction/contract/subprocessor/exit visibility. Mapping: CTRL-PROCESSOR-001, CTRL-VENDOR-001, CTRL-EXIT-001. Scope: vendor/service, role, data/country, contract clause map, assessment, subprocessor, finding. Non-goals: execute procurement or scrape portals. Dependencies: entity/inventory/evidence.

UX: lifecycle and expiring/change queue. Data/API/events: vendors/processors/contracts/ assessments; /vendors; subprocessor.change_proposed.v1. Security: vendor cannot approve self; tenant evidence isolation; malware scan.

Acceptance: Given subprocessor country/data change, affected transfer/contract assessment reopens. Given expired critical contract, new instruction is blocked by policy.

Evidence/metrics/rollout: due diligence/clause/approval; critical complete profiles/finding age; CSV migration → vendor portal later.

MVP-09 — Audit and evidence · L

Problem/persona: auditor/control owner needs reproducible, tamper-evident packs. Mapping: CTRL-AUDIT-001. Scope: append-only events, evidence refs/tests, stale state, scoped export, signed manifest. Non-goals: compliance score/certificate. Dependencies: KMS/object storage, every domain mutation.

UX: control-to-evidence and verification. Data/API/events: audit/evidence/export; /evidence; export.generated.v1. Security: hash chain, KMS root, WORM option, two-person mass export, redaction.

Acceptance: Given audit write failure, protected domain mutation fails atomically. Given artefact tampering, verification fails and pack is quarantined. Given partial workflow, pack cannot show complete.

Evidence/metrics/rollout: self-verifying manifest; freshness/verification; internal verifier → pilot auditor.

MVP-10 — PostgreSQL metadata and generic task connectors · XL

Problem/persona: system owner needs discovery/action without central PII. Mapping: CTRL-PROPAGATION-001, CTRL-DELETE-001. Scope: signed local agent, schema-only PostgreSQL scan, generic webhook/ITSM task, health/dead letter. Non-goals: arbitrary remote code/raw sampling and broad catalogue. Dependencies: package signing, mTLS, queue.

UX: capability/scope test, freshness and failure. Data/API/events: connectors/credentials refs/sync runs/dead letters; /connectors; scan.completed.v1. Security: no arbitrary query, egress allow-list, short tokens, PII response budget.

Acceptance: Given sample disabled, no cell value crosses boundary. Given ambiguous destructive timeout, no blind retry. Given tampered instruction/package, agent rejects and alerts.

Evidence/metrics/rollout: policy/run manifest/outcome; freshness/failure/PII budget; lab → customer test DB → scoped production metadata.

MVP-11 — Banking/fintech sector pack · L

Problem/persona: regulated entity legal/CISO need a non-generic overlay. Mapping: LEG-RBI-001, DPDP/CERT-In controls. Scope: entity categories, RBI IT outsourcing/governance, core systems, AA/TCCCPR distinctions, conflict templates. Non-goals: claim every fintech is regulated or complete all RBI activity rules without review. Dependencies: MVP-02/06/07/08.

UX: category/licence gate and open-counsel questions. Data/events: sector config and obligation impact. Security: regulated evidence/access and India location config.

Acceptance: Given no RBI category, sector obligation cannot auto-apply. Given AA consent, it is linked but not treated as general DPDP consent. Given CERT-In and DPDP triggers, both clocks run.

Evidence/metrics/rollout: sector approval/conflict map; unresolved critical questions; counsel review → design partner.

MVP-12 — Secure self-hosted deployment · XL

Problem/persona: customer CISO/platform team needs sovereign operation and exit. Mapping: CTRL-SEC-001, CTRL-XBRD-002, CTRL-EXIT-001. Scope: Compose evaluation, Helm/Kubernetes, external PostgreSQL/object/KMS/secrets, backup/restore, upgrades, telemetry off. Non-goals: production support for every distro/air-gap in MVP. Dependencies: application images, migration, release signing.

UX: preflight and health/status; no phone-home. Data/API/events: deployment config and privacy-safe operational metrics. Security: non-root, network policy, signatures/SBOM, customer keys, tenant tests.

Acceptance: Given network egress denied, core product operates without telemetry/licence callback. Given restore from before synthetic deletion, tombstone replay removes it before access. Given exit, customer verifies open-format export and credential revocation.

Evidence/metrics/rollout: signed artefacts/restore/exit; SLO/RPO/RTO; reference cluster → customer VPC → supported Kubernetes matrix.

Next, Later and Not planned

Next: SAML/SCIM, Java examples/SDK, language workflow, ServiceNow/Jira, dedicated/VPC, continuous evidence and second sector pack. Later: mobile SDKs, Oracle/SQL Server/FHIR/SAP, policy-as-code cloud checks, air-gapped LTS and statutory Consent Manager only behind Board registration/standards. Not planned: automated compliance certification, penalty prediction, identity/biometric vault, adtech graph, covert monitoring and blockchain default.