# Design review and permission matrix

Blank work product. Replace bracketed fields with system-specific facts. Unknown evidence stays unknown; do not mark a control passed because a template is complete.

## Scope and invariant

- Product / revision / environment: [exact target]
- Decision owner / review date: [person, date]
- Operation and asset: [one sensitive action and what could be lost]
- Security invariant: [actor may perform action on object only when …]
- Excluded surfaces and why: [explicit exclusions]

## Data flow and authority

| Hop | Input / output | Trusted identity source | Sensitive action | Enforcing component | Open assumption |
| --- | --- | --- | --- | --- | --- |
| [browser→API] | [request] | [verified session] | [read/write] | [service] | [unknown] |
| [API→queue→worker] | [job] | [bound actor and tenant] | [export] | [worker] | [revocation behavior] |
| [worker→cache→download] | [bytes] | [authorized audience] | [disclosure] | [download handler] | [cache isolation] |

## Permission matrix

| Actor / role | Tenant relationship | Object relationship | Action | Expected | Source of each fact | Test ID |
| --- | --- | --- | --- | --- | --- | --- |
| [legitimate] | [same] | [owner] | [read] | [allow] | [sources] | [ID] |
| [attacker] | [cross-tenant] | [none] | [read] | [deny] | [sources] | [ID] |

## Abuse cases and decisions

| Goal / entry | Preconditions | Failure mechanism | Control / owner | Acceptance evidence | Residual risk / trigger |
| --- | --- | --- | --- | --- | --- |
| [specific goal] | [attacker access] | [boundary crossed] | [enforcing code] | [positive and negative test] | [remaining risk] |

Record whether the design is accepted, conditionally accepted or blocked; list conditions, dates and who can accept them. Revisit when identity, storage audience, queue format or privileged administration changes.