# URS — User Requirements Specification (template)

**System:** AARJAY GDP Portal  
**Status:** Template — populate & approve before regulated go-live  
**Related evidence:** `REMEDIATION_EXECUTED_TEST_REPORT.md`, in-app Validation Pack URS section

## Critical requirements (remediation-aligned)

| ID | Requirement | Verification |
|----|-------------|--------------|
| URS-STOCK-01 | Stock cannot go negative; movements atomic | `scripts/tests/stock_ledger_remediation_test.php` |
| URS-DISP-01 | Dispatch release decrements stock before status complete | `dispatch_grn_atomicity_test.php` |
| URS-GRN-01 | GRN accept creates stock before accepted status | same |
| URS-AUTH-01 | Site isolation fail-closed for non-admins | RecordAuthorisationService / siteScopeSql |
| URS-ESIGN-01 | High-risk e-sign bound to content + MFA step-up when enrolled | EsignService + MfaService |
| URS-TRADE-01 | Trade override RP/Deputy (+delegated) with e-sign | TradeGateService |
| URS-AUDIT-01 | activity_log append-only at DB layer | mig 286 triggers |
| URS-EVID-01 | Uploads scanned when scanner required | MalwareScanService |

## Approval

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Author | | | |
| QA | | | |
| RP | | | |
