Compatibility: Pactmark 0.1.x. A checked box here is an operator decision backed by environment-specific evidence, not a Pactmark certification. Nothing on this page transfers responsibility to a framework test result.
Work through this before a production gate, and record an owner and an evidence link for each line. “We discussed it” is not evidence.

​
Identity and tenancy

Including the paths you added last week. A single unauthenticated inspection endpoint is a cross-tenant read.
Verify with negative tests, not by reading code. Every store method takes tenant identity for a reason.
Name people, not teams. Break-glass access needs a named approver and an audit path.
Grants expire; the process that issues them does not expire on its own.

​
Data and secrets

Each of those is a different record with a different lifecycle. One retention policy for all of them means the strictest one is being violated.
sslmode=verify-full. An unverified TLS connection authenticates nothing.
Verify egress origins and regions. Check that no canary value appears in any persisted or output surface.

​
Reliability

In an environment shaped like production, not in the unit-test harness.
Measured, from an actual restore and an actual later-process resume. Not chosen because the number looked reasonable.
Parked runs are the one most often missing, and the one that quietly accumulates liability.
Back up events, work orders, command records, effect ledgers, artifacts, protected stores and migration state together.

​
Operational decision

A drill you have not run is a plan, not a capability.
Including how you turn it off. Teardown is part of readiness.

​
Let the tooling tell you what is missing

Production doctor fails when required durability, sandbox, credential, policy or registration evidence is absent. Read its output as a checklist rather than as an error, and re-run it in the target environment — not on a developer laptop.

​
The honest framing

Pactmark can tell you that its own controls are configured. It cannot tell you that your identity provider maps roles correctly, that your database is backed up, that your on-call rotation is staffed, or that your risk-class mapping matches your risk appetite. Those are the parts that actually decide whether this goes well.

Responsibility matrix

Line by line: what Pactmark provides and what you own.

Threat model

Eighteen high and critical rows with owners and residual risk.