Responsibility and evidence matrix
This sample concerns a fictional supplier portal. It is a planning aid, not a security assessment or a client case study.
The business owner approves which suppliers may access which records. The developer implements that rule at every protected action. A reviewer tests two supplier accounts against the same direct record URL. The maintainer receives instructions to revoke access and inspect the event history.
Create four columns for each important decision: rule, responsible person, observable test and recovery action. Add account removal, failed imports, changed prices and an unavailable provider. If a row has no owner or cannot be tested, resolve it before implementation. Keep business approval distinct from technical implementation evidence.