Example

Risk lane from a thin story

Classify a thin story into a lane with a plain-language why, before standup. Not a score.

Notes you paste

Add “Sign in with your company” on the customer portal. Touches auth, session length, and an unowned security questionnaire. US first.

First draft

Lane: C — High impact / compliance-sensitive

Why
Touches partner login, session length, and an unowned security questionnaire. Blast radius is the customer portal, not a side admin screen.

What would move it
Name an owner for the questionnaire. Ship behind a flag so an IdP mistake is reversible.

Open questions
Is SCIM in v1? Which IdPs besides Okta?

Fake example — no real systems. Review before anything official.