One-line boundary statement.
public-product pattern
TrustBoundary
Explain what data stays local, leaves the device, requires an account, or needs human judgment.
complyeaze/core · candidate · @sanchika/patternsProduct job
Know what crosses a named boundary, what never crosses, and who controls the next action.
Explain what data stays local, leaves the device, requires an account, or needs human judgment.
Anatomy and required fields
Account, upload, network, permission, and review facts.
Sensitive data or credentials that do not cross the named boundary.
Person or system that controls a boundary-crossing action.
Inspectable source for the boundary statement.
Inspect, permission, fallback, or handoff action.
- boundarySummary
- boundaryFacts
- neverCrosses
- actionOwner
- sourceEvidence
- safeAction
Default and edge states
No artifact leaves the device.
- local
- no upload
- output destination
A capability must be granted.
- permission
- purpose
- fallback
An artifact must leave the device.
- destination
- reason
- processor
The boundary cannot be completed safely.
- unavailable
- reason
- manual path
Composed synthetic exemplar
State coverage
Default and consequential edges remain inspectable.
Trust, source, and consumer obligations
- Do not imply government affiliation, guaranteed outcomes, or unstated production readiness.
- Name account, upload, local-processing, external-destination, and human-review boundaries before action.
- Supply current product copy, sources, destinations, prices, review ownership, and all runtime behavior.
- Stack facts after the claim on narrow screens.
- Keep boundary summary before the related action in DOM order.
- Retain labelled boundaries, native link underlines, focus outlines, and status text without authored color.
- Keep all claims, proof, boundaries, and actions visible without entrance or layout motion.
Compact API reference
- Package
@sanchika/patterns- CSS
@sanchika/patterns/styles.css- Base class
sk-pattern-trust-boundary- Group
public-product