Security & Compliance

UC-NFR-003: Encryption at Rest

Purpose: Protect sensitive customer data.

Property	Value
Actor	System
Trigger	Data write
Priority	P0

Main Success Scenario:

1. App writes customer PII to database.
2. Database storage engine encrypts block/row using AES-256.
3. Key management service handles key rotation.

Acceptance Criteria:

1. [ ] Compliance with local data protection laws.
2. [ ] Keys rotated every 90 days.

UC-NFR-004: Role-Based Access Control (RBAC)

Purpose: Restrict access based on user role.

Property	Value
Actor	System
Trigger	User attempts action
Priority	P0

Main Success Scenario:

1. "Receptionist" user attempts to "Export All Data".
2. System checks permissions.
3. Access denied (HTTP 403).

Acceptance Criteria:

1. [ ] Granular permissions per module.
2. [ ] Default deny for all resources.