The SaaS build

Every business table gets an organisation_id and row-level security enabled in the same migration that creates it, not added in a cleanup pass later. Slower up front, since every new table needs its access rules worked out before it can be used, but it avoids the common multi-tenant failure: a table quietly missing tenant isolation until someone notices in production.

Likelihood and impact live on the audit; risk_rating lives on the finding; a separate risks table holds risk broader than one finding. Collapsing them into one concept would be simpler to build, but would lose the real distinction between how risky the audit is, how serious this specific issue is, and what the standing risk register entry connects to.

Subscriptions and billing are explicitly deferred until the core workflow, audit creation through report generation, is solid end to end. For a SaaS product, delaying monetisation infrastructure is a real sequencing call: prove the workflow works before building the layer that charges for it.

A phased plan for AI-assisted report drafting was researched and written up in detail against the real codebase, then set aside on purpose. Test the app for a month first, and come back to it after the core product has actually been used, not before.

Changing a member's audit access started failing in production with a missing-column error. The cause was one migration getting skipped when migrations were applied manually, while later ones went through fine. Diagnosed by checking what was actually missing rather than guessing, then fixed by running the skipped migration directly.

Signup during the beta is gated behind an invite code checked against a single environment variable, not a new database table or invite system. If the beta opens up later, that's one variable removed, not a migration to undo.

Draft reports can pull current findings, evidence and actions while they are being reviewed. Once issued, the report is snapshotted and locked so later changes do not alter the official audit record. That trades convenience for audit integrity.

A remediation action can be marked complete, but the finding only closes after review of completion evidence. That keeps closure tied to evidence, not to someone saying the work is done.

Every change goes through an actual production build before it counts as done, checked against the real output, not an AI's claim that something works. That single habit catches a real class of problem: a broken build, a stale link left over from a domain change, a component fixed in one place but still broken in three others.

When a proposed feature risked moving the build outside its agreed scope, the call was to flag it and stop, not build around it silently. The same standard applied to content: illustrative mockups that could pass as real client documents were sent back with a requirement for an explicit disclosure label before anything shipped.

A stale portfolio link, a phase-gating conflict, and a UI bug reported once but present in four near-identical places were all caught by re-checking the actual code and output, not by accepting a plausible-sounding summary. The skill being exercised is direction and verification, not typing.