Requirement Register
Illustrative rows for a fictional collaboration tool, Halden, shipping guest access.
| ID | Requirement | Keyword | Acceptance criteria | Evidence | Status |
|---|---|---|---|---|---|
| R-01 | A guest reads a shared board with no account | MUST | Unauthenticated session renders the board read-only. No signup screen appears at any point. | EV-01, EV-02 | Specified |
| R-02 | A share link expires | MUST | A 30 day link returns the expired state on day 31 and does not render content. | EV-05 | Specified |
| R-04 | A share link is not guessable or enumerable | MUST NOT | Tokens carry 128+ bits of entropy from a CSPRNG. Sequential creation reveals no relationship. | EV-05 | Blocked Q-03 |
| R-05 | Admins are notified on a guest's first open | SHOULD | One notification per link on first render. Subsequent opens do not notify. | EV-05 | Specified |
| R-06 | A guest comments without an account | SHOULD | Comment appears attributed to a name supplied at comment time. | EV-01 | Blocked Q-01 |
| R-07 | A guest reacts to comments with emoji | MAY | A guest adds and removes a reaction. | none | Specified |
| R-08 | Guests do not consume a seat | MUST | A workspace at its seat limit shares successfully. Invoice and seat count unchanged. | EV-02, EV-03, EV-04 | Specified |
SHOULD is the keyword that earns its keep: it tells an engineer they have real latitude, and obliges them to weigh the implications before taking it. R-07 is a MAY citing no evidence, which is how a preference stays honest instead of acquiring a plausible reason.