.offrails/blueprints/feature-spec.md

Feature: {{name}}

Why

{{The user problem this solves.}}

Who

{{Which users can see it? Which can change it?}}

What (data)

FieldMeaningRequired?Rules
{{title}}{{…}}yes{{max 200 chars}}

Behavior

  • {{When X happens, Y.}}
  • {{Side effects: emails, notifications, live updates.}}
  • {{On delete: …}}

Screens

  • {{List page: shows … sorted by …}}
  • {{Form: …}}

Acceptance criteria

  • AC-{{feature}}-1: {{A logged-in user can create a book with a title and author}}
  • AC-{{feature}}-2: {{Creating a book without a title shows "Title can't be blank"}}
  • AC-{{feature}}-3: {{Only the owner sees the Edit and Delete buttons}}

Security (agent-written threat model)

  • Assets: {{what an attacker wants here: other users' books, reviews, emails, sessions, money}}
  • Actors: {{anonymous · user · other user · other tenant · admin · compromised account}}
  • Entry points: {{routes, socket topics, jobs, inbound email, webhooks, uploads this feature adds}}
STRIDEThreatControlTest
Spoofing{{someone acts as another user}}{{RequireUser + session digest}}{{anonymous_cannot_create_a_book}}
Tampering{{edits another user's record / mass-assigns owner_id}}{{policy + Params without ownership fields}}{{other_user_gets_404_on_update}}
Repudiation{{admin action can't be traced}}{{logged with actor id}}{{…}}
Information disclosure{{IDOR, cached private page, enumeration}}{{owner-scoped query, no-store, same response for unknown emails}}{{…}}
Denial of service{{flooding, huge uploads}}{{rate limit, body limit}}{{…}}
Elevation of privilege{{user reaches admin action}}{{AdminAccess / role policy}}{{…}}

Assumptions (agent-written)

  • {{Assumed X because the spec didn't say. Change this line to change the behavior.}}

Open questions

  • {{Questions waiting on the human. The agent proceeds with the assumption above meanwhile.}}