Non-Functional Requirements
Owner: Engineering
Reviewers: Security, QA, Operations
Status: Draft
Version: 0.1
Last Updated: 2026-09-16
Review Cycle: Per release
Requirements
| Area |
Requirement |
Current Status |
| Security |
JWT access tokens, refresh token handling, protected routes and password hashing. |
PARTIAL |
| Authorization |
Enforce role and farm scopes consistently across backend APIs. |
PARTIAL |
| Rate limiting |
Apply API throttling to protect public endpoints. |
CONFIRMED |
| Reliability |
Health endpoint, container health checks and restartable services. |
PARTIAL |
| Observability |
Logs, activity logs and basic operational visibility. |
PARTIAL |
| Performance |
Support dashboard and telemetry queries without blocking core operations. |
TBD |
| Data integrity |
Prisma migrations and constraints define canonical relational data. |
PARTIAL |
| Maintainability |
Modular backend, feature-oriented web/mobile structure and documented conventions. |
CONFIRMED |
| Scalability |
Docker and K8s manifests provide deployable backend infrastructure. |
PARTIAL |
| Privacy |
Secrets and credentials must stay out of source control. |
PARTIAL |
| Recoverability |
Backup and restore process for PostgreSQL/Redis/telemetry data. |
TBD |
Known NFR Gaps
| Gap |
Required Follow-Up |
| Temporary authorization bypasses |
Remove bypasses and add regression tests. |
| No confirmed production monitoring stack |
Decide metrics/logging provider and alert channels. |
| No confirmed RPO/RTO |
Define backup, restore and disaster recovery targets. |
| AI behavior not implemented |
Define safety, citation and privacy requirements before build. |