Story · NP-AUTH-321Parent registration with controlled credentialsDraft
AI obligation mapPrivacy, credential security, and accessibility review.Human review required
Jira-ready story — staged, not sent
Parent registration with controlled credentials
As a parent, I want to create a secure account so that I can manage our family wishlist.
Awaiting AI interpretation
Acceptance criteriaGiven a parent submits registration, when the credentials meet the approved policy, then the account is created only after the defined verification and consent gates.
AI control attachmentsPassword policy, one-way password storage, privacy/consent screening, and accessible form behaviour are attached for human approval.
Evidence to collectPeer review, automated control checks, QA acceptance results, accessibility result, and deployment-gate record.
As a parent, I want to create a secure account so that I can manage our family wishlist with appropriate verification and consent.
Acceptance criteria
Given a parent submits registration, when the credential meets AUTH-PASS-016 and storage meets AUTH-PASS-017, then the account is created only after the verification and consent gates complete.
Given a credential below the approved length or composition, when registration is attempted, then it is rejected with an accessible, plain-language error.
Given guardian consent has not completed, when any child-linked record would be written, then persistence is blocked — including drafts.
Held centrally, pulled into development, QA, and deployment. A production standard would still need security approval.
LengthAt least 16 characters.
CompositionAlphabetic, numeric, and special-character classes.
RotationChange required after 90 days.
16-character minimumWaiting
Alphabetic + numeric + special characterWaiting
Password age ≤ 90 daysWaiting
AUTH-PASS-017
Password storage: one-way hash, never reversible encryption
Prohibits plaintext, reversible encryption, and fast hashes. Requires an approved adaptive profile with a unique per-password salt.
Requirement trigger“Create an account” signals a credential is being stored.
AI mappingAttach AUTH-PASS-017 and flag security review.
Central ruleArgon2id profile, unique salt, versioned parameters, no credential logging.
Delivery outputsJira criterion, repository check, QA scenario, and release evidence.
Choose the approach the AI sees in a proposed change. Nothing is hashed, stored, or sent.
AI control status: select an approach to demonstrate the enforcement decision.
Compliance lens, not a legal claim. NIST requires salting and hashing with a suitable password-hashing scheme; OWASP advises strong, slow password hashing and says passwords should not use reversible encryption. Many global laws require appropriate security measures without naming one fixed algorithm, so this internal control is an organisation-approved implementation of that obligation. NIST SP 800-63B · OWASP Password Storage
One approved policy becomes evidence in every phase. The records below update as you evaluate.
Development
Central packs AUTH-PASS-016 and AUTH-PASS-017 are imported. Review blocks a disallowed storage approach.
Waiting for control checksQuality assurance
Tests cover weak credentials, a compliant one, 91-day rotation, and no recovery of a stored hash.
Waiting for control checksOperations
Evidence names the policy version and hash profile, and bars credentials from logs.
Waiting for control checks
In production this would link to the pull request, test run, and release record. This page shows the chain only.
The point of the model: people write the intent, AI maps the obligations, named experts approve. The same rules are then enforced through development, QA, and operations.
* The production workbench is internal — reachable over the corporate VPN only. This public page is a local demonstration.