NFR003 - Security - Non-repudiation: unclear wording

[bluesteens]

for Steering

NFR003 contains a mix of SHALL and SHOULD that makes it unclear whether the auditability and logging are obligations or -good-to-haves. suggest determining OCI's intention and reword accordingly.

---

wording:

Solution SHOULD implement an audit trail including non-repudiable digital signatures for all ATP Credential transactions realized on the system. User authentication and activities SHALL be logged. Audit trail SHALL be available for user inspection.

---

Triage:

• Is Issue appropriate for OCI Architecture
• Assign Size
• Assign Priority
• Assign Label (if needed)
• OCI affected Artifacts Identified
• Assign Triage - Artifact Version Target (v x.x.x Milestone)
• Assign Triage - Interop Profile Version Target (v x.x.x Milestone)
• Create sub-project (if needed)

Affected Parties (help determine Sunrise/Sunset):

• Trading Partners
• Issuers
• Wallet Solutions
• PI Verification Solutions

Affected OCI Artifact

• Schema Document
• Identity Schema
• ATP Schema
• Issuer Conformance Criteria
• Wallet Conformance Criteria
• VRS Solution Conformance Criteria
• Wallet API Specification
• Governance Document
• Conformance Program
• OCI Website
• Internal Process

Change Category (Guides Steering Review)

- Steering/Industry Review

• Business-Level (May affect business operations)
• OCI Governance, Policy or website feature

- Steering/Industry Notification

• Technical-Level (Does not affect business operations)
• OCI Internal Process or Infrastructure

Communication

• Website
• Newsletter
• email:
• Other:

[bluesteens]

already addressed by #43