V2 requirements

[elarlang]

I'll propose the list here. If there is no immediate agreement on changes, I'll spin off those into separate issues.

---

2.1.3 Verify that expectations for business logic limits and validations are documented including both per-user and also globally across the application.

commas, both + also (one is not needed)

---

2.2.1 commas

---

2.2.2 Verify that the application is designed to enforce input validation at a trusted service layer. While client-side validation improves usability, it must not be relied upon as a security control.

To be clear, that the use client-side validation is encouraged (and not to be interpreted as disallowed):

While client-side validation is encouraged to be used to improve usability, it must not be relied upon as a security control.

---

2.3.1 Verify that the application will only process business logic flows for the same user in sequential step order and without skipping steps.

in the expected sequential step order?

---

2.3.4 commas

2.3.4 Verify that high-value business logic flows are restricted with multi-user approval to prevent unauthorized or accidental actions. This could include but is not limited to large monetary transfers, contract approvals, access to critical nuclear facility operations, healthcare record modifications, access to classified information, or safety overrides in manufacturing.

• "access to critical nuclear facility operations" - really? :) A bit niche to be worth mentioning here.
• "healthcare record modifications" - it may depend on the change, but in general I don't think it belongs to the list
• "or safety overrides in manufacturing" - feels a bit niche as well

Seems to be originating from #1576

---

2.4.2 Verify that business logic processes require realistic human timing, preventing excessively rapid transaction submissions.

The "logic process" is not the best description here. Maybe "using business logic flows" or something on that direction?

[tghosth]

Opened #2865