@capagents/forgeqe 0.0.0-stage → 1.0.1

package/evals/domain/access-role-change.yaml

@@ -0,0 +1,37 @@
+id: access-role-change
+title: Assign roles in the admin console
+domain:
+  industry: financial services back office
+  regulations: [ISO 27001, SOX]
+compliance: |
+  ## Controls in scope
+  - CTL-ACC-02 (ISO 27001, SOX): a role change takes effect only after a second administrator approves it (maker-checker).
+  - CTL-AUD-03 (ISO 27001, SOX): every role change is logged with who requested it, who approved it, when, and the old and new roles.
+story:
+  title: Give a user a role
+  description: As an administrator I want to give a user a role in the back-office console, so that they can do their job.
+  acceptance: |
+    - The administrator searches for a user, picks a role, and saves.
+    - The user's roles list shows the new role.
+expect:
+  - id: assigned
+    source: story
+    covers: After saving, the user's roles list shows the new role.
+  - id: maker-checker
+    source: regulation
+    covers: A second administrator must approve the change before it takes effect; the requester cannot approve their own request.
+  - id: self-grant
+    source: regulation
+    covers: An administrator cannot give a role to themselves.
+  - id: audit
+    source: regulation
+    covers: The change is logged with who requested and approved it, when, and the old and new roles.
+  - id: unauthorised
+    source: domain
+    covers: A user without administrator rights cannot open the console or assign roles, including by going to its URL directly.
+  - id: revoke
+    source: domain
+    covers: Removing a role takes effect at once, including for a user who is signed in.
+  - id: conflicting-roles
+    source: regulation
+    covers: Roles that must not be held together (for example creating and approving payments) cannot be given to the same user.

package/evals/domain/banking-payment-transfer.yaml

@@ -0,0 +1,41 @@
+id: banking-payment-transfer
+title: Send money to a saved beneficiary
+domain:
+  industry: retail banking
+  regulations: [PSD2, DORA, GDPR]
+compliance: |
+  ## Controls in scope
+  - CTL-AUD-01 (DORA, ISO 27001): every payment and every change to a beneficiary is written to the audit log with who, when, and the values.
+  - CTL-SCA-01 (PSD2): initiating a payment requires strong customer authentication (two of knowledge, possession, inherence).
+story:
+  title: Pay a saved beneficiary
+  description: As a customer I want to send money from my current account to a beneficiary I saved earlier, so that I do not have to type their details again.
+  acceptance: |
+    - The customer picks a saved beneficiary, enters an amount and a reference, and confirms.
+    - A confirmation page shows the amount, the beneficiary, and the reference.
+    - The account balance shows the payment.
+expect:
+  - id: confirmation
+    source: story
+    covers: The confirmation shows the amount, beneficiary, and reference entered.
+  - id: duplicate
+    source: domain
+    covers: Submitting twice (double click, refresh, or back and resubmit) does not create a second payment.
+  - id: funds-limits
+    source: domain
+    covers: An amount above the available balance or a payment limit is refused with a clear message and no payment is made.
+  - id: amount-format
+    source: domain
+    covers: Zero, negative, and amounts with more than two decimals are refused.
+  - id: execution-date
+    source: domain
+    covers: Payments made after the cut-off time or on a non-business day show and use the correct execution date.
+  - id: sca
+    source: regulation
+    covers: Confirming the payment requires strong customer authentication (for example a one-time code); without it no payment is made.
+  - id: audit
+    source: regulation
+    covers: The payment is recorded in the audit log with who made it, when, and the details.
+  - id: failure
+    source: regulation
+    covers: When the payment service fails or times out, the customer sees a clear error and no partial or unknown payment results (operational resilience).

package/evals/domain/gdpr-account-erasure.yaml

@@ -0,0 +1,30 @@
+id: gdpr-account-erasure
+title: Delete my account
+domain:
+  industry: online retail
+  regulations: [GDPR]
+story:
+  title: Delete my account
+  description: As a customer I want to delete my account, so that the shop no longer has my data.
+  acceptance: |
+    - The customer chooses Delete account in My account and confirms.
+    - The customer is signed out and sees a confirmation.
+expect:
+  - id: confirmed
+    source: story
+    covers: After confirming, the customer is signed out and sees a confirmation.
+  - id: reauth
+    source: domain
+    covers: Deleting the account asks the customer to prove it is them again (password or one-time code) first.
+  - id: data-gone
+    source: regulation
+    covers: The customer's personal data (profile, addresses, saved payment methods) is removed, and the account can no longer be signed in to.
+  - id: retained
+    source: regulation
+    covers: Records the shop must keep by law (for example invoices) are kept, without more personal data than that obligation needs.
+  - id: marketing
+    source: regulation
+    covers: Marketing messages stop after the account is deleted.
+  - id: open-orders
+    source: domain
+    covers: An account with open orders or a pending refund is handled first (blocked with an explanation, or deleted only after they complete).

package/evals/domain/insurance-claim-fnol.yaml

@@ -0,0 +1,30 @@
+id: insurance-claim-fnol
+title: Report a home insurance claim
+domain:
+  industry: home insurance
+  regulations: [GDPR]
+story:
+  title: Report a claim online
+  description: As a policyholder I want to report damage to my home online, so that my claim starts without a phone call.
+  acceptance: |
+    - The customer enters the date of the incident, what happened, and uploads photos.
+    - On submit, a claim reference is shown.
+expect:
+  - id: reference
+    source: story
+    covers: Submitting the claim shows a claim reference.
+  - id: cover-dates
+    source: domain
+    covers: An incident date before the policy started, after it ended, or in the future is refused.
+  - id: duplicate-claim
+    source: domain
+    covers: A second claim for the same incident is detected or flagged instead of creating an unrelated duplicate.
+  - id: uploads
+    source: domain
+    covers: Uploads of an unsupported type or over the size limit are refused with a clear message, and valid ones are kept.
+  - id: lapsed
+    source: domain
+    covers: A claim on a cancelled or lapsed policy is refused or routed for review.
+  - id: minimisation
+    source: regulation
+    covers: The form asks only for data the claim needs, and the claim's personal data is visible only to the customer and authorised claim handlers.

package/evals/domain/insurance-policy-renewal.yaml

@@ -0,0 +1,37 @@
+id: insurance-policy-renewal
+title: Renew a motor policy online
+domain:
+  industry: personal lines motor insurance
+  regulations: [IDD, GDPR]
+compliance: |
+  ## Controls in scope
+  - CTL-IDD-03 (IDD): the insurance product information document and the demands and needs statement are shown before the customer accepts.
+story:
+  title: Renew my car insurance online
+  description: As a policyholder I want to renew my motor policy online from the renewal invitation, so that I stay covered.
+  acceptance: |
+    - The renewal page shows the renewal premium and the cover.
+    - The customer can change their annual mileage before accepting.
+    - The customer accepts and pays, and sees a renewal confirmation.
+expect:
+  - id: confirmation
+    source: story
+    covers: Accepting and paying shows a renewal confirmation.
+  - id: premium-recalc
+    source: domain
+    covers: Changing the annual mileage recalculates the premium before acceptance, and the accepted premium is the recalculated one.
+  - id: dates
+    source: domain
+    covers: The renewed policy starts the day after the current one ends, with no gap or overlap in cover.
+  - id: quote-expiry
+    source: domain
+    covers: A renewal quote that has expired, or a policy that has already lapsed, cannot be accepted as it stands.
+  - id: payment-failure
+    source: domain
+    covers: A failed or declined payment leaves the policy not renewed and tells the customer.
+  - id: pre-contract-info
+    source: regulation
+    covers: The product information document and the demands and needs statement are shown before the customer can accept.
+  - id: consent
+    source: regulation
+    covers: Marketing consent is asked separately and is not pre-ticked; renewal does not depend on it.

package/evals/domain/lending-loan-application.yaml

@@ -0,0 +1,36 @@
+id: lending-loan-application
+title: Apply for a personal loan
+domain:
+  industry: consumer lending
+  regulations: [Consumer Credit Directive, AML, GDPR]
+story:
+  title: Apply for a personal loan
+  description: As a customer I want to apply for a personal loan online and get a decision, so that I can borrow quickly.
+  acceptance: |
+    - The customer enters the amount, the term, and their income and outgoings.
+    - The customer submits and sees whether the loan is approved.
+expect:
+  - id: decision
+    source: story
+    covers: Submitting the application shows a decision.
+  - id: identity
+    source: regulation
+    covers: The customer's identity is verified before a loan is granted (anti-money laundering checks), and a failed check stops or refers the application.
+  - id: affordability
+    source: regulation
+    covers: Income and outgoings are used to assess affordability; an unaffordable loan is not approved as asked.
+  - id: cost-disclosure
+    source: regulation
+    covers: The APR, the total amount payable, and the repayments are shown before the customer commits.
+  - id: withdrawal
+    source: regulation
+    covers: The customer is told of the right to withdraw from the agreement (14 days).
+  - id: eligibility
+    source: domain
+    covers: Applicants under 18, and amounts or terms outside the product's range, are refused.
+  - id: automated-decision
+    source: regulation
+    covers: A declined applicant is told the outcome and can ask for the decision to be reviewed by a person.
+  - id: credit-check-consent
+    source: regulation
+    covers: The customer is told a credit check will be made before it is made.