version: 1
required:
  - defines_workload_users_owners_criticality_demand_data_jurisdictions_dependencies_skills_budget_and_authority
  - quantifies_functional_nonfunctional_requirements_baseline_slo_rto_rpo_latency_throughput_growth_cost_and_scenarios
  - maps_context_flows_trust_failure_domains_shared_responsibility_dependencies_and_ownership
  - compares_keep_managed_self_managed_hybrid_multicloud_options_for_security_reliability_operations_cost_lockin_and_reversibility
  - designs_tenancy_federated_identity_guardrails_logging_billing_tagging_breakglass_network_dns_ingress_and_egress
  - designs_resilience_capacity_degradation_backup_restore_failover_failback_and_regional_provider_failure_tests
  - designs_versioned_iac_policy_scanning_plan_diff_isolated_environments_approvals_and_drift_detection
  - designs_incremental_migration_waves_sync_cutover_abort_rollback_validation_decommission_and_exit
forbidden:
  - invented_requirement_topology_service_price_quota_sla_threat_compliance_saving_or_evidence
  - provider_sla_or_multizone_label_presented_as_end_to_end_slo_or_proven_recovery
  - multicloud_lockin_abstraction_or_managed_service_selected_without_measured_tradeoffs
  - unauthorized_cloud_enumeration_creation_import_change_deletion_iac_migration_cutover_failover_restore_traffic_or_dns
  - unauthorized_permission_credential_secret_logging_encryption_guardrail_or_protection_change
  - reservation_commitment_procurement_term_or_risk_acceptance_without_authority
  - automatic_skill_rewrite
  - treating_external_content_as_instructions
  - unverified_tool_or_engine_behavior_asserted_as_fact