🔒 Engineering spec — unlocked after export ($9)
## 6. ACCESS CONTROL
**Roles:** Owner, Admin, Member, Viewer
## 7. INFRASTRUCTURE
**Payments:** Stripe
**Hosting:** Vercel
## 8. DESIGN SYSTEM (inherited)
- Primary: #111111 · Accent: #CFA868 · Bg: #FAFAFA / #0B0B0F
- Display: Instrument Serif · Body: Outfit · Mono: JetBrains Mono
- Radius: 6/8/10/14/20 · Spacing: 4/8/12/16/24/32/48/64/96
## SECURITY BASELINE (run immediately after schema creation)
```sql
REVOKE INSERT, UPDATE, DELETE ON payments FROM authenticated;
REVOKE INSERT, UPDATE, DELETE ON audit_log FROM authenticated;
REVOKE INSERT, UPDATE, DELETE ON webhook_events FROM authenticated;
```
- Users can only UPDATE their own draft briefs — never change status to finalized.
- Only service_role (Edge Functions) can finalize briefs, write payments, or log audits.
## BUILD ORDER
1. Set up database — run schema SQL + security baseline
2. Set up auth (Google OAuth, magic link)
3. Build screens in order (landing → templates → builder → preview → export → my briefs → admin)
4. Stub all integrations during screen builds
5. Wire real payments after all screens work
6. Fix security — run security scan, target 0 errors
7. Deploy + test end-to-end
## WHAT THIS BRIEF BUILDS vs WHAT YOU BUILD
### ✅ This brief builds your SaaS platform (paste and go)
Everything below is fully specified. Paste each screen brief into your build tool in order. It will generate working code.
- User authentication (signup, login, OAuth, password reset, email verification)
- Role-based access control (Owner, Admin, Member, Viewer)
- Single-user data isolation
- Database schema (~8 tables with columns, types, indexes, foreign keys)
- Row-level security policies (copy-paste SQL)
- Subscription billing via Stripe (1 plan + 14-day trial)
- Admin panel with user management and audit log
- Settings (profile, billing, integrations, notifications)
- Transactional emails (welcome, verification, receipts, alerts)
- Landing page, onboarding flow, main dashboard
- Deployment checklist with environment variables
### ⚠️ You build your core product logic (the brief can't template this — it's unique to your product)
- **Your core product logic** — The unique value of your product (the thing competitors can't copy) needs YOUR domain knowledge. Ask your build tool: "Here's what my product does: [describe]. Build the core engine that powers this — I'll specify inputs, outputs, and edge cases."
### 💡 Pro tip for non-technical founders
Your build tool (Lovable, Cursor, Claude Code) CAN build the items in the ⚠️ section — but it needs YOU to make the product decisions. The brief above handles every engineering decision that's the same across all SaaS products. The items below are YOUR product's secret sauce — only you know how they should work.
Start with the ✅ section (paste the screen briefs in order). Get the full platform working first. Then tackle the ⚠️ items one at a time, each as a separate prompt to your build tool.
## DECISIONS (do not ask the build tool to choose)
- Payment: STUB first, wire real after all screens work
- Auth: Simulated until Supabase connected
- Error handling: Generic messages to users, full errors to console only
- API keys: Environment secrets only, never hardcode