# Product release assurance pack

This is a reusable packet for one product and candidate. The completed example below uses synthetic evidence to demonstrate traceability.

## 1. Scope and claim — blank

- Product, accountable owner and intended deployment: [facts]
- Source revision, artifact digest and configuration revision: [immutable identities]
- Included operations and trust boundaries: [list]
- Excluded surfaces, reason and separate owner: [list]
- Standard edition and selected requirement identifiers: [verify against primary source]
- Claim being evaluated: [narrow, testable statement]
- Risk acceptance authority and release blocking rules: [record]

## 2. Traceability matrix — blank

| Local requirement | Versioned source and relationship | System-specific interpretation | Enforcement location | Repeatable procedure | Expected response and effect | Actual evidence / candidate | Status / owner |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [ID] | [supports / partially supports] | [operation and boundary] | [code/config] | [accounts, setup, inputs] | [allow AND deny] | [run ID, artifact, observed result] | [pass/fail/unknown/excluded] |

A guide or a completed worksheet is learning support; it is not the implementation evidence. Store the procedure, data fixture, runtime/configuration, actual result, reviewer and artifact identity together. A mapped requirement must be assessed across the stated scope, not only the easiest endpoint.

## 3. Exception and release decision — blank

For each unmet requirement, record the exact affected operations and candidate, risk, tested compensating control, named accountable accepter, expiry date, remediation owner, verification procedure and automatic expiry action. An exception remains an exception, not a passed control. Record the final decision, dependencies and the evidence that would change the decision.

## 4. Completed example: LedgerDesk r44

Owner Mira. Candidate source r44, artifact `sha256:4444444444444444444444444444444444444444444444444444444444444444`, config c12. Included: invoice search, object reads, profile updates and private exports. Excluded: mobile client, payment provider and support impersonation; those exclusions cannot appear in an assurance claim. Selected ASVS requirements inform application checks; the two SSDF tasks below inform the evidence process. This packet makes no claim of a complete ASVS level or full SSDF implementation.

| Local requirement | Verified source | System-specific interpretation | Enforcement / procedure | Synthetic result and evidence | Decision |
| --- | --- | --- | --- | --- | --- |
| LD-QUERY | ASVS v5.0.0-1.2.4 | Search values cannot change query structure | Fixed repository query; ordinary terms, quote characters and tenant scope in Q-01–Q-04 | run44-Q passes on r44/4444…; export calls same repository but requires its own authorization tests | Supported for listed query paths |
| LD-OUTPUT | ASVS v5.0.0-1.2.1 | Invoice descriptions remain text in HTML output | Framework text rendering; R-01 ordinary text, R-02 active markup, R-03 quote/ampersand strings | run44-R passes; receipt email output is untested | Open for email surface; exclude email output from release until checked |
| LD-OBJECT | ASVS v5.0.0-8.2.2 | Only owners or authorized tenant finance-admins read invoices | Service policy; A-01 owner, A-02 other owner, A-03 permitted admin; use WSTG v4.2 ATHZ-04 to vary references | run44-A passes for HTTP and worker paths | Supported for listed cases |
| LD-FIELD | ASVS v5.0.0-8.2.3 | Ordinary users cannot write role or tenant membership | DTO allowlist plus permission checks; F-01 legitimate edit and F-02 protected-field attempt | run44-F passes; role and tenant unchanged after rejection | Supported for profile route |
| LD-TENANT | ASVS v5.0.0-8.4.1 | Every included operation stays in its authorized tenant | Cross-tenant API, queue, download and cache-order tests T-01–T-06 | run44-T passes except T-05 revoked queued actor | Fail; export stays disabled |
| LD-CRITERIA | SSDF 1.1 PO.4.1 | Product defines its security acceptance criteria before release | Release policy c12 names blocking disclosure and protected-field failures | policy c12 approved by Mira; no retrospective relaxation | Process evidence recorded |
| LD-TEST | SSDF 1.1 PW.8.2 | Scoped tests retain results and route defects into engineering work | Runs above retain fixtures and failures; defect F-118 links T-05 to owner and retest | issue F-118 assigned Ravi, due exercise date + 7 days | Process evidence recorded; technical failure remains |

## 5. Exception X-44 and release decision

Proposed reduced release: disable private exports and receipt email in every reachable API/worker route while shipping invoice search and profile updates. Mira may accept only after run44-disable proves no export job can be queued or consumed, no old export download remains reachable, and receipt email is disabled. Capture actual controls and results; a feature flag screenshot alone is insufficient.

X-44 expires seven days after the exercise decision. Ravi owns execution-time membership repair; Jules owns receipt-email output verification; Noor retests both and the legitimate user paths. Expiry leaves both features disabled and escalates to Mira. No exception allows a known active cross-tenant disclosure. Current decision is **blocked pending disablement verification**. If that verification passes on the same candidate/configuration, the claim may be limited to the tested enabled operations. The original failures remain visible until repaired and retested.

Before rollout, record the running artifact digest and configuration. After rollout, perform safe synthetic-user checks. Archive this packet with its exact fixtures and results. On later candidates, reuse the procedures and reassess the results rather than carrying a pass forward.

## Sources and relationship limits

- [OWASP ASVS 5.0.0 requirements](https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/docs_en/OWASP_Application_Security_Verification_Standard_5.0.0_en.flat.json): selected IDs verified directly on 9 October 2026. The short interpretations above are this product example's scope, not substituted standard text.
- [OWASP WSTG 4.2 object-reference testing](https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References/): WSTG-ATHZ-04 is a testing method supporting the object-access procedure; it is not equivalent to all ASVS authorization requirements.
- [NIST SSDF 1.1, SP 800-218](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf): PO.4.1 and PW.8.2 verified directly on 9 October 2026. Process evidence does not pass a failed product control.