Requirements

/arckit.requirements <project ID or feature>

# Create requirements for existing project
/arckit.requirements 001

# Focus on specific feature
/arckit.requirements authentication module

# New project
/arckit.requirements Build a payment processing system

**BR-001**: Cost Reduction
**Statement**: The system MUST reduce invoice processing operational costs by 40% within 12 months of go-live.
**Rationale**: Addresses CFO Goal G-1 (from ARC-001-STKE-v1.0.md)
**Acceptance Criteria**:
- FTE count reduced from 20 to 13 by Month 12
- Processing cost per invoice reduced from £15 to £9
- Annual savings of £700K achieved by Year 2
**Priority**: MUST
**Stakeholder**: CFO (Primary), Finance Director (Secondary)

**FR-012**: Invoice Approval Workflow
**Statement**: As a Finance Manager, I MUST be able to approve invoices via mobile app so that I can approve invoices while traveling.
**Acceptance Criteria**:
- Mobile app available on iOS 14+ and Android 11+
- Push notification when invoice awaiting approval
- Approve/reject with mandatory comment
- Digital signature capture for audit trail
- Offline mode with sync when connected
**Priority**: MUST
**User Persona**: Finance Manager (Sarah, 45, travels 40% of time)
**User Journey**: Invoice Approval Flow (see FR-012-journey.png)

**NFR-P-001**: API Response Time
**Statement**: Payment API MUST respond within 2 seconds for 95th percentile under normal load.
**Rationale**: Aligns with Security by Design principle (SEC-001)
**Test Method**: Load testing with JMeter, 1000 concurrent users
**Priority**: MUST

**NFR-SEC-003**: Data Encryption
**Statement**: All payment card data MUST be encrypted at rest using AES-256 and in transit using TLS 1.3.
**Rationale**: PCI-DSS 4.0 Requirement 3.5, aligns with Encryption principle (SEC-005)
**Test Method**: Penetration testing, code review
**Priority**: MUST

**NFR-S-001**: Horizontal Scaling
**Statement**: The system MUST support horizontal scaling to handle 300% traffic increase during Black Friday.
**Rationale**: Aligns with Scalability principle (ARCH-001)
**Test Method**: Load testing, auto-scaling validation
**Priority**: MUST

**NFR-A-001**: Uptime SLA
**Statement**: The system MUST maintain 99.95% uptime (< 4.38 hours downtime/year).
**Rationale**: Addresses Operations Director Outcome O-3 (from ARC-001-STKE-v1.0.md)
**Test Method**: Monitoring dashboards, incident logs
**Priority**: MUST

**NFR-C-002**: GDPR Right to Erasure
**Statement**: The system MUST delete all personal data within 30 days of data subject request.
**Rationale**: GDPR Article 17, DPA 2018 compliance
**Test Method**: DPIA validation, data lineage audit
**Priority**: MUST

**INT-003**: CRM System Integration
**Upstream System**: Salesforce CRM
**Data Exchange**: Customer profile, payment history
**Protocol**: REST API with OAuth 2.0
**Frequency**: Real-time (< 5 second latency)
**Data Format**: JSON payload, OpenAPI 3.0 specification
**Error Handling**: Retry 3 times with exponential backoff, dead letter queue for failures
**SLA**: 99.9% availability, < 500ms response time (p95)
**Priority**: MUST

**DR-005**: Transaction Data Retention
**Data Entity**: Payment Transaction (E-002 from data model)
**Retention Period**: 7 years (financial records regulation)
**Archival Strategy**: Move to cold storage after 2 years
**PII Classification**: Contains PII (cardholder name, email)
**GDPR Lawful Basis**: Contract (Article 6(1)(b))
**Encryption**: AES-256 at rest, TLS 1.3 in transit
**Access Control**: Finance team (read), Payment API (write), Audit (read-only)
**Priority**: MUST

Stakeholder: CFO (from ARC-{PROJECT_ID}-STKE-v*.md)
  → Goal G-1: Reduce infrastructure costs 40% by end of Year 1
    → BR-001: System MUST reduce operational costs by 40%
      → NFR-P-001: API response time < 2s (enables automation → cost reduction)
        → Success: CFO Outcome O-1 measured monthly

### Conflict: Security vs Usability

**Conflicting Requirements**:
- NFR-SEC-002: CISO requires MFA for all users (MUST)
- FR-008: Product Owner wants passwordless login (MUST)

**Stakeholders Involved**:
- CISO (HIGH power, HIGH interest) wants maximum security
- Product Owner (MEDIUM power, HIGH interest) wants user satisfaction

**Trade-off Analysis**:
- **Option A**: MFA for all → Security satisfied, users frustrated (NPS drops)
- **Option B**: Passwordless for all → Users happy, CISO blocks go-live
- **Option C** (Chosen): Risk-based authentication

**Resolution Strategy**: COMPROMISE
- Admin users: MFA mandatory (satisfies CISO)
- Regular users: Passwordless with biometrics (satisfies Product)
- High-risk actions: Step-up MFA (e.g., large payments)

**Decision Authority**: CTO (RACI: Accountable)
**Approval Date**: 2025-10-29
**Updated Requirements**:
- NFR-SEC-002a: Admin users MUST use MFA
- FR-008a: Regular users MAY use passwordless login
- NFR-SEC-002b: High-risk actions MUST trigger step-up MFA