Translation. Authoritative: ../../design/open-questions-v2.md.
How this is ordered
Not every question is the same kind, and mixing them means answering 70 things when only 52 are actually yours to decide.| Group | Count | Who decides | When |
|---|---|---|---|
| A. Block approval | 52 | You | before its spec reaches approved |
| B. Belong to the lawyer | 7 | Daniel + lawyer | in the same package as legal/ |
| C. Are commercial | 10 | You, with the pricing exercise | before commercial launch |
| D. Blocked by an ADR | 1 | research, not a decision | when the ADR is written |
review and from there to approved. Groups B and C block
nothing.
Group A — Block approval
identity (16)
| ID | Question | REC |
|---|---|---|
| OQ-IDN-01 | MFA mandatory for every user, or only for roles with sensitive permissions? | Only for sensitive roles. Forcing it on an assistant who only reads a dashboard adds friction without reducing risk; the permission model already marks what is sensitive. |
| OQ-IDN-02 | Console session lifetime: 12 hours, or 30 days sliding with re-prompts? | 30 days sliding with re-prompts. Twelve hours pushes people to save passwords in the browser, which is worse. |
| OQ-IDN-03 | Passkeys in F1a, or is password plus magic link enough? | F1a. Better Auth already supports them and the marginal cost is low. |
| OQ-IDN-04 | Invitation expiry: 7 or 14 days? | 7 days. A two-week invitation is a live token sitting in an inbox for two weeks. |
| OQ-IDN-05 | Can a user delete their own account, and what happens to memberships? | They can leave an organization, not delete the account. Deleting while memberships are active leaves holes in the audit trail. |
| OQ-IDN-06 | Is a “billing” system role missing? | Yes, add it. The most common case the current five do not cover. |
| OQ-IDN-07 | Minimum password length: 12, or 10 with a breach check? | 12 with a breach check. The check is what works; 12 is today’s reasonable floor against offline brute force. |
| OQ-IDN-08 | Is the sensitive-action list configurable per organization, or fixed? | Fixed. It is a security list, not a preference. |
| OQ-IDN-09 | Do API keys expire by default? | No by default, with optional expiry. A self-expiring key breaks an integration at 3 a.m.; rotation with overlap is the right mechanism. |
| OQ-IDN-10 | Rotation overlap window: 24 h, or configurable up to 7 days? | Configurable up to 7 days, default 24 h. A weekly deploy cycle needs more than a day to propagate. |
| OQ-IDN-11 | Are OAuth clients reviewed before activation, or self-service? | Reviewed by us in F1b. At the initial volume the review is cheap and prevents the first reputational incident. |
| OQ-IDN-12 | Refresh token absolute lifetime: 30 or 90 days? | 90 days with rotation. Rotation with reuse detection is the real protection. |
| OQ-IDN-13 | Which social providers first? | Google and Microsoft. They cover nearly the whole B2B market; GitHub can follow. |
| OQ-IDN-14 | Can a tenant disable impersonation entirely? | Yes, with an explicit slower-support warning. Being able to say no is what makes it credible that it is audited when they say yes. |
| OQ-IDN-15 | Default impersonation window: 60 minutes, or 30 with easy renewal? | 60 minutes. Easy renewal turns the window into a formality rather than a limit. |
| OQ-IDN-16 | Do we offer optional account linking later, for agencies? | Recorded, not now. Answered when a real customer asks. |
core (18)
| ID | Question | REC |
|---|---|---|
| OQ-CORE-01 | Which vertical taxonomy ships second? | Retail. Highest event volume and best exercise for the rules engine; health and services bring sensitive data better tackled once the legal package is reviewed. |
| OQ-CORE-02 | Does an anonymous contact’s event history survive if they never become known? | Purged at 90 days. Retaining behaviour of someone who never identified themselves accumulates personal data without a purpose. |
| OQ-CORE-03 | Do we seed Central America and Mexico now? | No. South America covers the target market; adding a country is a row plus a normalizer. |
| OQ-CORE-04 | Is email unique per tenant, or can two contacts share one? | They can share. Households and shared business inboxes are real. The uniqueness that matters is the document’s. |
| OQ-CORE-05 | Do we normalize phones to E.164 and reject the rest? | Normalize yes, reject no. A badly formatted phone does not prevent operating the way an invalid document does. |
| OQ-CORE-06 | Is a national ID match a verified identity on its own? | Yes. A document with a valid check digit, within a tenant, is the strongest signal we have. |
| OQ-CORE-07 | Merge field conflict policy: most recent, or survivor always? | Most recent non-null. The survivor is chosen by age, not by data quality. |
| OQ-CORE-08 | Do we version consent text, or is it an opaque tenant string? | Opaque tenant string. The text is theirs and their responsibility. |
| OQ-CORE-09 | Hash-chain the audit log now, or append-only plus grants in F1? | Append-only plus grants in F1. The chain protects against an attacker with database write access, which is a scenario where we have already lost. |
| OQ-CORE-10 | Do we accept events with a future occurred_at, and what tolerance? | Yes, 5 minutes. POS clocks drift. Beyond that, accept but stamp with received_at and flag. |
| OQ-CORE-11 | processed_jobs TTL: 7 days, or longer? | 7 days. Comfortably exceeds the maximum retry window. |
| OQ-CORE-12 | Should an unreviewed dead letter escalate? | Yes, at 7 days with raised severity. A forgotten dead letter is an effect that never happened. |
| OQ-CORE-13 | Maximum segment DSL depth and node count? | Depth 5, 50 nodes. Enough for any realistic RFM, and it bounds incremental evaluation cost. |
| OQ-CORE-14 | Do RFM templates ship with the taxonomy or separately? | With the taxonomy. They are why installing one is worth it on day one. |
| OQ-CORE-15 | Member session lifetime: 30 days sliding, or shorter? | 30 days sliding, with a re-prompt to redeem. Members visit rarely and from a phone. |
| OQ-CORE-16 | Does token exchange support refresh, or does the tenant re-exchange? | Re-exchange. The tenant already governs the member’s session in their own system. |
| OQ-CORE-17 | Can more than one taxonomy be installed, and how do collisions resolve? | Yes, and an event-name collision is rejected by name. Retail with subscriptions is a real case. |
| OQ-CORE-18 | Do we support a list (multi-value) attribute type? | Not in F1b. Multi-value complicates the segment builder for a case usually better modelled as a taxonomy. |
messaging (12)
| ID | Question | REC |
|---|---|---|
| OQ-MSG-01 | Open and click tracking on by default? | Clicks yes, opens no. The open pixel is what regulators and mail clients dislike, and Apple Mail has falsified it for years — so the data is bad and politically expensive. A click is a deliberate action. |
| OQ-MSG-02 | Default quiet hours for a new tenant | 21:00–09:00 local. A permissive default means the first tenant discovers quiet hours when a member complains about a 3 a.m. email. |
| OQ-MSG-03 | Can a tenant override a system template (OTP, invitation)? | Branding yes, content no. An OTP with editable text is one someone will accidentally turn into phishing. |
| OQ-MSG-04 | How long is rendered content retained? | 90 days. Enough for support and disputes; 25 months accumulates the text of every message to every person. |
| OQ-MSG-05 | Default marketing frequency cap | 3 per week. Above that, unsubscribe rates rise faster than conversion. |
| OQ-MSG-06 | Can a member re-subscribe after a complaint, or only after a bounce? | Only after a bounce. A spam complaint is a signal carriers record. |
| OQ-MSG-07 | Transactional depth threshold at which marketing yields | A function of throughput: when depth exceeds 30 seconds of pending work. A fixed number is wrong for either large or small tenants. |
| OQ-MSG-08 | Consecutive webhook failures before deactivation | A rate: 20 consecutive, or 50% over an hour. Consecutive-only leaves alive an endpoint that fails half the time. |
| OQ-MSG-09 | Do in-app notifications expire? | At 90 days if unread. An infinite inbox is one nobody opens. |
| OQ-MSG-10 | Default local send window for date-property campaigns | 09:00–11:00. Best open rates in most markets and it bothers nobody. |
| OQ-MSG-11 | Maximum blast size before a second confirmation | 10 000 recipients. Below that, double confirmation is friction; above, a mistake costs domain reputation. |
| OQ-MSG-12 | Do we request a Resend limit raise before G1, and to what number? | Yes, to 50 rps. With the batch endpoint that is 5 000 messages per second theoretical — enough headroom for dual rails to have real margin. |
crm (8)
| ID | Question | REC |
|---|---|---|
| OQ-CRM-01 | Can a note be edited, or only appended to? | Editable with visible history. Append-only sounds more defensible but produces notes full of corrections nobody reads. |
| OQ-CRM-02 | Are activities assignable to any user, or only the owner? | Any active member of the organization. Restricting it turns a team tool into a personal list. |
| OQ-CRM-03 | Maximum note length | 10 000 characters. Fits any real note and stops someone pasting a whole document. |
| OQ-CRM-04 | Can an activity attach to a loyalty event? | Yes, with an optional reference. “Follow up on this redemption” is the case that connects the two modules. |
| OQ-CRM-05 | Maximum static list size | 5 000 contacts, with a warning at 1 000. Above that it should almost always be a segment. |
| OQ-CRM-06 | Can a saved view reference a dynamic segment? | Yes. The DSL already allows it. |
| OQ-CRM-07 | Default timeline date range when none is supplied | 90 days. Rejecting is correct but hostile to a first integrator. |
| OQ-CRM-08 | Per-source timeout before degrading | 300 ms. With sources in parallel, the 1 s budget absorbs it plus the merge. |
Group B — Belong to the lawyer (7)
These are not answered by intuition. They go in the same package aslegal/ when it is reviewed.
| ID | Question | Affects | Note for the lawyer |
|---|---|---|---|
| OQ-LEG-01 | Does consent expire after a period of inactivity? | FS-CORE-0004 | Some readings of Ley 21.719 suggest so. If it does, we need the period and a re-consent flow. |
| OQ-LEG-02 | Legal minimum retention for the audit log | FS-CORE-0005 | 5 years by tax adjacency, or shorter for non-financial entities? Sets the floor under the per-plan policy. |
| OQ-LEG-03 | Do we accept a consent column in CSV imports? | FS-CORE-0013 | A tenant asserting they have consent is not the same as having it. Does it expose us as processor? |
| OQ-LEG-04 | Does the tenant get a window to object before an erasure? | FS-CORE-0014 | The data subject exercises against the controller, who is the tenant. Can we execute without their confirmation? |
| OQ-LEG-05 | How long do we retain subject_requests after completion? | FS-CORE-0014 | It is the proof we complied. Is there a maximum, or is it indefinite? |
| OQ-LEG-06 | Does point expiry have legal limits in supported countries? | FS-LOY-0002 | Consumer protection. Determines whether the vertical templates’ default policy is even lawful. |
| OQ-LEG-07 | Last-owner lockout process for an organization | FS-IDN-0005 | What identity verification is sufficient and defensible to restore access? |
Group C — Commercial (10)
These block no spec. They are answered with the pricing exercise (P-3).| ID | Question | Affects |
|---|---|---|
| OQ-COM-01 | Are custom roles plan-gated? | FS-IDN-0002 |
| OQ-COM-02 | Is enterprise SSO an enterprise tier, or on every plan? | FS-IDN-0008 |
| OQ-COM-03 | Is the custom domain add-on per domain or per tenant? | FS-MSG-0008 |
| OQ-COM-04 | Is SMS included in a plan or always pay-as-you-go? | FS-MSG-0009 |
| OQ-COM-05 | How many programs does the base plan include? | FS-LOY-0001 |
| OQ-COM-06 | How many attribute definitions per tenant, and is it plan-gated? | FS-CORE-0011 |
| OQ-COM-07 | Maximum import file size and row count, plan-gated? | FS-CORE-0013 |
| OQ-COM-08 | Is storage metered by database bytes, exported archive bytes, or both? | FS-CORE-0010 |
| OQ-COM-09 | Does a spend cap stop the Runtime API or only billable effects? | FS-CORE-0010 |
| OQ-COM-10 | P-3: unit prices per metric | ADR-016 |
track breaks a customer’s point of sale over a
commercial debt, which is disproportionate damage; ceasing to award points and send messages hurts
where it should without breaking the operation.
Group D — Blocked by an ADR (1)
| ID | Item | Nature |
|---|---|---|
| OQ-ADR-01 | SMS provider and per-country coverage | Research, not a decision. FS-MSG-0009 stays draft until the ADR exists. |
How one is closed
- You answer
OQ-XXX-NN: <decision>. - The decision enters the spec’s normative section and disappears from its open-questions table.
- The spec’s version rises and it moves to
review, then toapprovedwith your sign-off. - The translation is updated in the same change — the
translationvalidator requires it. - The row is marked closed with the date and the answer.
Changelog
| Version | Date | Change | Why | Author |
|---|---|---|---|---|
| 2.0.0 | 2026-08-17 | Initial register: 70 questions from identity, core, messaging and crm, grouped by who decides | Separate 52 decisions of yours from 7 for the lawyer and 10 commercial, so that answering group A unblocks 37 specs | daniel + claude-opus-5 |