The intended product boundary: a source never receives a citizen’s open vault; an office never receives a document until the citizen grants the exact, limited permission.
One company-specific credential and one permitted document category per delivery.
Private storage, organization, notification events, and a complete record of document activity.
The citizen sees who is requesting access and approves the exact package, purpose, tax year, and duration.
The office receives only the authorized package and retains its own brand, portal, and client relationship.
Production identity connections require official provider approval and registered redirect/security controls. They are not assumed by the MVP.
Private buckets, KMS encryption, Secrets Manager, token expiry, rate limits, logging safeguards, and multi-tenant authorization belong in the production AWS environment.
Tax software connectors stay mock/placeholder until the vendor provides official APIs, credentials, documentation, and contractual permission.
HTTPS-only public entry points for office servers, sources, and citizen sessions.
Separate operational data from private document objects and never expose permanent document links.
Visibility and response are part of the service, not an afterthought.