Traceability Matrix
Purpose: Maps every PRD requirement to its downstream implementation. When the PRD changes, this matrix identifies exactly which documents and tasks need review.
Convention: Each row links a PRD requirement (FR-XX-NN or NFR-XX-NN) to its architectural decision, domain specification section, and implementation task. Rows marked — are pending.
How to use: When updating a PRD requirement, check the corresponding rows below. Update or re-validate every linked artifact. Update this matrix with the new version.
Functional Requirements Traceability
Workflow Orchestration (PRD §6.1)
| FR ID |
Requirement |
Architecture Decision |
Domain Spec |
Implementation Task |
| FR-WF-01 |
Configurable Workflow Templates |
— |
— |
— |
| FR-WF-02 |
Dynamic Branching |
— |
— |
— |
| FR-WF-03 |
Parallel Task Execution |
— |
— |
— |
| FR-WF-04 |
Human Task Management |
— |
— |
— |
| FR-WF-05 |
SLA Timers and Breach Actions |
— |
— |
— |
| FR-WF-06 |
Retry and Error Handling |
— |
— |
— |
| FR-WF-07 |
Workflow Instance State Machine |
— |
— |
— |
Customer Onboarding (PRD §6.2)
Name Screening (PRD §6.3)
| FR ID |
Requirement |
Architecture Decision |
Domain Spec |
Implementation Task |
| FR-NS-01 |
Match Against Watchlists |
— |
Screening Spec |
— |
| FR-NS-02 |
Matching Algorithms |
— |
Screening Spec |
— |
| FR-NS-03 |
Analyst Adjudication |
— |
Screening Spec |
— |
Customer Risk Rating (PRD §6.4)
Case Management (PRD §6.5)
Network Analysis (PRD §6.6)
Configuration Engine (PRD §6.7)
Audit & Governance (PRD §6.8)
| FR ID |
Requirement |
Architecture Decision |
Domain Spec |
Implementation Task |
| FR-AU-01 |
Immutable Audit Log |
— |
Audit Spec |
— |
| FR-AU-02 |
Decision Reconstruction |
— |
Audit Spec |
— |
| FR-AU-03 |
Segregation of Duties |
— |
Audit Spec |
— |
RBAC & Security (PRD §6.9)
| FR ID |
Requirement |
Architecture Decision |
Domain Spec |
Implementation Task |
| FR-SC-01 |
Role-Based Access Control |
— |
— |
— |
| FR-SC-02 |
Authentication |
— |
— |
— |
Notification (PRD §6.10)
| FR ID |
Requirement |
Architecture Decision |
Domain Spec |
Implementation Task |
| FR-NT-01 |
Notifications |
— |
— |
— |
Non-Functional Requirements Traceability
| NFR ID |
Requirement |
Architecture Decision |
Implementation Task |
| NFR-P01 |
UI Responsiveness (2s) |
— |
— |
| NFR-P02 |
Screening Response (5s) |
— |
— |
| NFR-P03 |
Concurrent Workflows (100) |
— |
— |
| NFR-P04 |
Audit Log Throughput (1K/s) |
— |
— |
| NFR-S01 |
Encryption in Transit |
— |
— |
| NFR-S02 |
Encryption at Rest |
— |
— |
| NFR-S03 |
Authentication Strength |
— |
— |
| NFR-S04 |
Session Security |
— |
— |
| NFR-S05 |
Field-Level Access Control |
— |
— |
| NFR-S06 |
Privileged Access Monitoring |
— |
— |
| NFR-R01 |
System Uptime (99.5%) |
— |
— |
| NFR-R02 |
Graceful Degradation |
— |
— |
| NFR-R03 |
Data Durability |
— |
— |
| NFR-R04 |
Retry with Backoff |
— |
— |
| NFR-O01 |
Structured Logging |
— |
— |
| NFR-O02 |
Correlation IDs |
— |
— |
| NFR-O03 |
Health Check |
— |
— |
| NFR-O04 |
Key Metrics |
— |
— |
| NFR-U01 |
Low Click Count |
— |
— |
| NFR-U02 |
Error Messages |
— |
— |
| NFR-U03 |
Loading States |
— |
— |
| NFR-U04 |
Keyboard Navigation (P1) |
— |
— |
| NFR-M01 |
Modular Architecture |
— |
— |
| NFR-M02 |
Configuration Over Code |
— |
— |
| NFR-M03 |
API Versioning |
— |
— |
| NFR-M04 |
Test Coverage (80%) |
— |
— |
| NFR-C01 |
Audit Retention (7yr) |
— |
— |
| NFR-C02 |
Decision Reproducibility |
— |
— |
| NFR-C03 |
Data Minimization |
— |
— |
| NFR-C04 |
Right to Access/Erasure (P1) |
— |
— |
| NFR-A01 |
Consistent API Design |
— |
— |
| NFR-A02 |
Rate Limiting |
— |
— |
How to Update
- When a PRD requirement changes, find its row above.
- For each linked artifact in the row, either: (a) update it to match, or (b) re-validate it as still correct and note the re-validation date.
- Update the PRD Document History with the version bump and impact summary.
- If a new requirement is added, add a new row. If a requirement is removed, mark the row as
REMOVED vX.Y.
Matrix last validated against: PRD v1.0