# C-Suite Personas

Source: alirezarezvani/claude-skills C-suite tier (66 skills, founder-mode variants)

Adopt the appropriate voice and decision framework when producing client-facing deliverables, investor materials, or internal strategic docs. Always founder-mode by default (bootstrapped, solo-or-small-team context).

---

## CEO / Founder voice

**When:** Vision narratives, investor pitches, team announcements, press, strategic pivots.

**Decision framework — founder-mode:**

1. Does this create durable value for our users? (Not: does it look good on a slide?)
2. Can we ship it in ≤2 weeks solo + AI? (Not: what would a 20-person team build?)
3. Does it compound? (Feature adds value over time without ongoing cost)
4. Ruthless cut test: "If we drop this, do we lose a paying customer?" If no → drop.

**Tone:** Direct, conviction-first, short sentences, no hedging. No "I think", "maybe", "could potentially". Say what is true.

**Template — investor update (monthly):**

```
Month N — [date]
MRR: $X (+Y% MoM) | Customers: N | Churn: X%
Top win: [one sentence, specific]
Top risk: [one sentence, honest]
Focus next 30 days: [1-2 things max]
Ask: [specific, actionable — or "no ask"]
```

---

## CTO voice

**When:** Architecture decisions, tech debt prioritization, build vs. buy, vendor evaluation, team hiring (if applicable).

**Decision framework:**

1. What is the blast radius if this breaks in prod? (small → ship; large → gate + flag)
2. Does this increase or decrease our operational surface? (lock-in is a feature per `rules/cloudflare-lock-in-is-leverage.md`)
3. 12-month tech debt cost vs. 12-month velocity gain — explicit trade-off
4. Confidence score (0–1): below 0.7 → prototype first, never commit architecture

**Tone:** Precise, evidence-backed, calls out uncertainty explicitly. Uses numbers.

**Template — ADR (Architecture Decision Record):**

```
## ADR-NNN: [Decision title]
Date: YYYY-MM-DD | Status: proposed | accepted | deprecated
Context: [1-2 sentences — what forced this decision]
Decision: [Chosen approach — one sentence]
Alternatives considered: [Bullet list, one line each, why rejected]
Consequences: [Positive + negative trade-offs]
Confidence: 0.X
```

---

## CFO voice

**When:** Pricing decisions, budget requests, cost modeling, runway analysis, investor diligence.

**Decision framework:**

1. Unit economics first: does this move CAC, LTV, or payback period?
2. Fixed vs. variable cost — can we scale revenue without scaling headcount?
3. Cash runway: changes must not reduce runway below 12 months without explicit board approval
4. Payback period target: ≤12 months (SaaS standard); ≤6 months (bootstrapped target)

**Tone:** Numbers-first, no narrative preamble. Every claim has a source metric.

**Core metrics always in scope (see `finance-domain.md`):**

- MRR / ARR, MoM growth rate
- CAC (blended: paid + organic)
- LTV (LTV = ARPU × gross margin / churn rate)
- LTV:CAC ratio (target ≥3:1)
- Payback period (CAC / monthly gross margin per customer)
- Gross margin %, net margin %
- Burn rate, runway in months

---

## CMO voice

**When:** Go-to-market strategy, positioning, messaging, content calendar, paid acquisition.

**Decision framework:**

1. Who is the ICP (Ideal Customer Profile)? — specific job title + company size + pain
2. What is our unique mechanism? (Not "we're better" — why specifically)
3. Distribution channel priority: owned → earned → paid (in that order, per `rules/01-OS.md` § Distribution)
4. Content: one anchor piece per quarter, atomized into 10+ derivative pieces

**Tone:** Customer-first, outcome-focused, avoids engineering jargon.

**Template — positioning statement:**

```
For [ICP job title] at [company type],
[Product] is the [category] that [unique mechanism]
unlike [alternative], which [key weakness].
```

---

## CISO voice

**When:** Security architecture review, compliance scoping, vendor security questionnaires, incident response.

**Decision framework:**

1. Threat model first: who is the adversary, what do they want, what is their capability?
2. Defense in depth: never single control. Auth + encryption + network + audit trail.
3. Blast radius containment: every component isolated — D1 → per-table RLS, R2 → per-bucket IAM, Workers → per-route secret bindings.
4. Audit trail non-negotiable: every mutation logged with actor + timestamp + before/after.

**Tone:** Risk-framed. "The risk is X. The control is Y. The residual risk is Z." No ambiguity.

**Controls checklist (CF Workers stack):**

- [ ] Clerk JWT verified on every protected route
- [ ] Secrets via `wrangler secret` — zero in code/env files
- [ ] CSP Level 3 `strict-dynamic` + nonce on every HTML response
- [ ] Trusted Types enforced
- [ ] D1 parameterized queries only (no string concat)
- [ ] R2 presigned URLs, never public bucket
- [ ] Rate limiting on auth + mutation routes via CF Rate Limiting
- [ ] Audit log table with actor/action/entity/before/after/timestamp

---

## GC (General Counsel) voice

**When:** Terms of service, privacy policy, data processing agreements, contractor agreements, IP questions.

**Decision framework:**

1. What data do we collect? Where does it go? Who has access? (GDPR Art. 30 record)
2. What did we promise users? (ToS + Privacy Policy must be accurate — not aspirational)
3. What are our obligations to contractors? (Work-for-hire clause, NDA, IP assignment)
4. What is our exposure if X goes wrong? (Quantify, mitigate, or accept with board sign-off)

**Tone:** Precise, hedge-aware. "We should" → "We are required to" or "We choose to". Flags gaps explicitly.

**Standard documents to maintain:**

- `Privacy Policy` — GDPR Art. 13/14 compliant, plain English
- `Terms of Service` — limitation of liability, DMCA agent, dispute resolution
- `DPA (Data Processing Agreement)` — required for any EU B2B customer
- `Contractor Agreement` — IP assignment + NDA + work-for-hire

# Compliance OS

Source: alirezarezvani/claude-skills compliance tier (18 core + 9 specialized skills)

Compliance is not a one-time audit — it is an operating posture. Each framework below: what it requires, what the current stack already enforces, and what gaps remain.

---

## GDPR (EU General Data Protection Regulation)

**Scope:** Any product with EU users (including residents in the US).

**Core requirements:**

- **Art. 6** — lawful basis for every data collection (consent / contract / legitimate interest)
- **Art. 13/14** — privacy notice at collection point
- **Art. 17** — right to erasure ("delete my account" = 30-day response SLA)
- **Art. 20** — data portability (export in machine-readable format)
- **Art. 30** — record of processing activities (internal doc, not public)
- **Art. 32** — appropriate technical security (encryption at rest + in transit)
- **Art. 33** — 72-hour breach notification to supervisory authority
- **Art. 35** — DPIA required for high-risk processing (AI profiling, health data)

**What CF Workers stack already enforces:**

- TLS 1.3 everywhere (CF edge) — Art. 32 ✓
- D1 encryption at rest — Art. 32 ✓
- Clerk handles auth data in GDPR-compliant infra — Art. 32 ✓
- CSP + Trusted Types limit XSS data exfiltration surface — Art. 32 partial ✓

**Gaps to close:**

- [ ] Art. 17 — implement account deletion endpoint + D1 cascade + R2 object purge
- [ ] Art. 20 — `/api/user/export` → JSON download of all user data
- [ ] Art. 30 — maintain `docs/data-processing-record.md` per product
- [ ] Art. 33 — document breach response runbook; set CF alert for anomalous 5xx spike
- [ ] Cookie consent banner if using analytics cookies (PostHog uses cookieless mode by default — confirm)

**Enforcement:** `/c-suite-personas.md` § GC voice handles DPA drafts.

---

## SOC 2 Type II

**Scope:** Any B2B SaaS storing customer data. Required for mid-market / enterprise sales.

**Trust Service Criteria (TSC) relevant to CF Workers SaaS:**

| CC | Name | What it requires | Stack enforcement |
|---|---|---|---|
| CC1 | Control environment | Documented policies, risk assessment | `rules/autonomous-engineering.md` approval tiers |
| CC6 | Logical access | MFA, least privilege, access review | Clerk MFA + per-route auth guards |
| CC7 | System operations | Monitoring, anomaly detection, incident response | PostHog + Sentry + CF alerts |
| CC8 | Change management | Deployment controls, testing before prod | CI/CD gates + Playwright E2E + feature flags |
| CC9 | Risk mitigation | Vendor risk assessment | `rules/ai-agent-security.md` |
| A1 | Availability | Uptime SLA, backup, recovery | CF 99.99% SLA + D1 Time Travel + R2 versioning |
| C1 | Confidentiality | Encrypt sensitive data | D1 at-rest encryption + R2 SSE + TLS 1.3 |
| PI1 | Privacy | GDPR alignment | See GDPR section above |

**Evidence collection checklist (for auditor):**

- [ ] Access log: Clerk audit trail exported monthly
- [ ] Change log: git conventional commits + PR history (or `wrangler deployments list`)
- [ ] Incident log: Sentry issue history + resolution times
- [ ] Backup test: D1 Time Travel restore test quarterly (document in `ops/backup-tests.md`)
- [ ] Vulnerability scan: `npm audit` + `npx oxlint` + Playwright axe in CI — artifact per run
- [ ] Penetration test: annual (HackerOne self-managed or hired firm)

**Fastest path to SOC 2 Type I (declaration):** 3-6 months. Hire Vanta or Drata for automation if >$500K ARR.

---

## ISO 27001

**Scope:** Enterprise clients in EU, finance, healthcare, government — often required for procurement.

**Key controls (Annex A, relevant subset):**

- A.8.1 — Asset inventory (D1 tables, R2 buckets, KV namespaces, API keys)
- A.9.2 — User access management (Clerk roles + offboarding checklist)
- A.12.1 — Operational procedures documented
- A.12.6 — Vulnerability management (`npm audit` in CI, Dependabot alerts)
- A.14.2 — Security in development (code review gates, SAST)
- A.16.1 — Incident management (Sentry + runbook)
- A.17.1 — Business continuity (D1 Time Travel + R2 versioning + `wrangler rollback`)
- A.18.1 — Legal compliance (GDPR, local data residency)

**Gap vs. SOC 2:** ISO 27001 requires formal ISMS documentation and certification body audit. Skip unless a specific enterprise deal requires it — SOC 2 Type II satisfies most US buyers.

---

## HIPAA (Health Insurance Portability and Accountability Act)

**Scope:** Any product handling PHI (Protected Health Information) — patient data, health records, lab results.

**Core rules:**

- **Privacy Rule** — minimum necessary data collection; patient right to access + amendment
- **Security Rule** — administrative, physical, and technical safeguards for ePHI
- **Breach Notification Rule** — notify affected individuals + HHS within 60 days

**Technical safeguards (Security Rule §164.312):**

- Unique user ID + auto-logoff (Clerk satisfies)
- Encryption at rest + in transit (CF stack satisfies)
- Audit controls — all ePHI access logged (must add D1 audit log per-PHI-table)
- Integrity controls — detect unauthorized alteration (hash + timestamp on PHI records)

**CF Workers considerations:**

- CF has signed BAA — use CF-hosted infra only; no third-party APMs logging PHI payloads
- R2 presigned URLs with short TTL for any file containing PHI
- Never log PHI in Sentry or PostHog event properties — sanitize before capture
- Workers AI: do NOT send PHI to Workers AI unless CF has confirmed HIPAA eligibility for that model

**Brian's current gap:** No product handles PHI. If a client requires it, activate HIPAA mode: add BAA checklist, PHI-tagged D1 columns, audit log middleware, and data residency pin.

---

## ADA Title II (Americans with Disabilities Act)

**Scope:** State/local government programs AND businesses open to the public. Rule effective April 2026 for most entities.

**Technical standard:** WCAG 2.1 AA (DOJ rule) — WCAG 2.2 AA is the stack default (stricter, always satisfies).

**What the stack already enforces:**

- Playwright axe-core in CI at 6 breakpoints — zero violations gate per `rules/e2e-tdd-organization.md`
- `text-wrap: balance/pretty`, fluid type, OKLCH contrast — visual compliance
- Keyboard navigation tested in every E2E spec
- Lighthouse A11y ≥95 hard gate per `01-OS Hard Gates`

**Gaps to close for full ADA Title II compliance:**

- [ ] Published Accessibility Conformance Report (VPAT 2.4) for enterprise sales
- [ ] Feedback mechanism: `accessibility@domain.com` or in-app form (required by DOJ rule)
- [ ] Annual re-audit: schedule `npm run e2e:a11y` + manual keyboard walk + screen reader test (VoiceOver + NVDA)
- [ ] Caption all video content (auto-caption via Workers AI Whisper + human review)

**Enforcement hook:** `rules/e2e-tdd-organization.md` — axe violations = build fail. ADA Title II is already enforced at the test layer; the gap is documentation + feedback channel.

# Finance Domain

Source: alirezarezvani/claude-skills CFO + finance tier

Unit economics and SaaS metrics for solo AI builder. No MBA required — just the numbers that matter and what to do when they're off.

---

## Core SaaS Metrics

### MRR / ARR

```
MRR = sum of all active monthly subscriptions (normalized to monthly)
ARR = MRR × 12

MRR movement:
  New MRR     = revenue from new customers this month
  Expansion   = revenue from upgrades / seat adds
  Contraction = revenue from downgrades
  Churn MRR   = revenue lost from cancellations
  Net New MRR = New + Expansion − Contraction − Churn
```

**Healthy benchmarks (early SaaS, <$1M ARR):**

- MoM growth: ≥10% (T2D3 path requires 3× then 2× annual)
- Net MRR churn: <2% monthly (<−2% = net revenue retention growth)
- Net Revenue Retention (NRR): ≥100% (expansion covers churn)

---

### CAC (Customer Acquisition Cost)

```
CAC (blended) = total sales + marketing spend in period ÷ new customers acquired

CAC (paid)    = paid channel spend ÷ customers from paid channels
CAC (organic) = time cost of content + SEO ÷ customers from organic
```

**Solo AI builder CAC reality:** Organic + AI-assisted content is the primary channel. Paid CAC is a validation metric, not a growth engine until unit economics are proven.

**PostHog instrumentation:**

- Event: `signup_completed` with `{source: 'organic'|'paid'|'referral', channel: 'google'|'direct'|...}`
- Funnel: `landing_page_view` → `signup_started` → `signup_completed` → `activated` (first value action)

---

### LTV (Lifetime Value)

```
LTV = ARPU × gross margin % ÷ monthly churn rate

ARPU (Average Revenue Per User) = MRR ÷ active customers
Gross margin % = (revenue − COGS) ÷ revenue
  COGS for CF Workers SaaS: API costs + AI inference + D1/R2 storage + Clerk + Resend
Monthly churn rate = customers churned ÷ customers at start of month
```

**Example:**

```
ARPU = $49/mo, gross margin = 82%, churn = 3%/mo
LTV = $49 × 0.82 ÷ 0.03 = $1,337
```

---

### LTV:CAC Ratio

```
LTV:CAC = LTV ÷ CAC

Target:  ≥3:1 (sustainable)
Minimum: ≥1:1 (not losing money on customers)
Ideal:   ≥5:1 (capital-efficient growth)
```

**Warning signals:**

- LTV:CAC <3:1 → either reduce CAC (invest in SEO/content over paid) or increase LTV (pricing, expansion, reduce churn)
- LTV:CAC >10:1 → likely under-investing in growth; allocate more to acquisition

---

### Payback Period

```
Payback period = CAC ÷ (ARPU × gross margin %)

Target:     ≤12 months (SaaS standard)
Bootstrapped target: ≤6 months (cash-flow sensitivity)
```

**Example:**

```
CAC = $200, ARPU = $49, gross margin = 82%
Payback = $200 ÷ ($49 × 0.82) = $200 ÷ $40.18 = ~5 months ✓
```

---

## Runway Modeling

**Formula:**

```
Runway (months) = cash on hand ÷ monthly net burn

Net burn = monthly expenses − monthly revenue (MRR)
```

**Solo builder cash flow model (simple):**

| Line item | Monthly |
|---|---|
| Revenue (MRR) | +$X |
| CF Workers + Cloudflare stack | −$50-200 |
| AI inference (Workers AI / Anthropic) | −$X |
| Clerk | −$25-100 |
| Resend | −$20-50 |
| PostHog | −$0-450 (free tier generous) |
| Sentry | −$0-26 |
| Domain + SSL | −$5-20 (annualized) |
| Contractor / tools | −$X |
| **Net burn** | −$remaining |

**Runway rule:** Maintain ≥12 months runway at all times. Below 12 months → activate revenue acceleration or raise.

---

## Pricing Strategy

**Framework: Value Metric Pricing**

1. Identify the value metric (what correlates with customer value? — seats, usage, records, API calls)
2. Anchor price to value metric growth → expansion revenue without sales effort
3. Tiered: Free (viral / PLG) → Pro (individual) → Business (team) → Enterprise (custom)

**Brian's stack defaults:**

- Free tier: Clerk `free` plan + CF generous free tier — zero marginal cost for <100 users
- Pro: flat monthly (simple — reduces friction)
- Business: per-seat or per-usage (aligns with customer ROI)
- Enterprise: annual contract + custom D1 schema isolation + SLA + SOC 2 attestation

**Pricing decision tree:**

```
Is the value clearly volume-based (API calls, records processed)?
  → Usage-based pricing (metered via Stripe Billing)
Is value per-user (seats, logins)?
  → Per-seat pricing
Is value binary (use it or don't)?
  → Flat monthly
Is the buyer a large org with procurement process?
  → Annual contract with monthly equivalent + 15-20% discount for annual prepay
```

**Discount rules (protect pricing integrity):**

- Never discount >20% without board/advisor sign-off
- Discounts for: nonprofits (up to 50%), annual prepay (15%), pilot/POC (time-limited 30 days)
- Never discount for urgency, budget sensitivity alone — preserves perceived value

---

## Financial Reporting Templates

### Monthly P&L (solo SaaS)

```
Revenue
  MRR (subscriptions): $X
  One-time (setup/consulting): $X
  Total revenue: $X

COGS
  AI inference: $X
  CF infrastructure: $X
  Auth (Clerk): $X
  Email (Resend): $X
  Total COGS: $X

Gross profit: $X (XX%)

OpEx
  Software/tools: $X
  Contractors: $X
  Legal/accounting: $X
  Total OpEx: $X

EBITDA: $X (XX%)
```

### Investor-ready SaaS metrics table

| Metric | This month | Last month | MoM Δ | Target |
|---|---|---|---|---|
| MRR | $X | $X | +X% | $X |
| ARR | $X | — | — | $X |
| New MRR | $X | $X | — | — |
| Churn MRR | $X | $X | — | <2% |
| NRR | XX% | XX% | — | ≥100% |
| Active customers | N | N | +N | — |
| CAC | $X | $X | — | ≤$X |
| LTV | $X | $X | — | ≥3× CAC |
| Payback (mo) | N | N | — | ≤12 |
| Gross margin | XX% | XX% | — | ≥75% |
| Runway | N mo | N mo | — | ≥12 mo |

# PM Domain

Source: alirezarezvani/claude-skills product tier (17 skills)

Solo AI builder does not have a PM. Brian IS the PM. These frameworks ensure product decisions are structured, customer-grounded, and traceable.

---

## PRD (Product Requirements Document)

**When to write one:** Any feature >4h of implementation time, or any feature that will be customer-facing and requires stakeholder alignment.

**Template (lean — max 1 page):**

```markdown
## PRD: [Feature name]
Date: YYYY-MM-DD | Status: draft | approved | shipped | deprecated
Flag: `feature_flags.key_name` (experimental → beta → stable)

### Problem
[One paragraph. What user pain are we solving? Quantified if possible: "X% of users abandon at step Y".]

### Who
ICP: [Job title, company size, context]
User story: As a [persona], I want [action] so that [outcome].

### What (scope)
In: [Bullet list — what IS included]
Out: [Bullet list — what is explicitly NOT included]

### Success metrics
Primary: [One metric with target — e.g., "activation rate from 12% → 20% in 30 days"]
Secondary: [1-2 supporting metrics]
Anti-metric: [What we're NOT optimizing for]

### Acceptance criteria
- [ ] [Specific, testable, user-observable]
- [ ] [Map to E2E test steps in `e2e/FEATURES.md`]

### Design decisions
[Any non-obvious technical or UX choices and why]

### Risks
[Bullet list: risk + mitigation]

### Launch checklist
- [ ] Feature flag at `enabled=0, rollout=0, stage='experimental'`
- [ ] E2E test GREEN
- [ ] Lighthouse A11y ≥95
- [ ] PostHog event instrumented: `[feature]_[action]`
```

---

## OKR Framework

**Cadence:** Quarterly. Set week 1, review week 6, retrospect week 13.

**Structure:**

```
Objective: [Qualitative, inspirational, directional — not a metric]
  KR1: [Measurable, binary or 0-1 scale, specific deadline]
  KR2: [Same]
  KR3: [Same — max 3 KRs per O]
```

**Solo builder OKR rules:**

- Max 2 objectives per quarter (one = not stretching, three = fragmented)
- Every KR has a single owner: Brian (or a named agent/system)
- KR grade ≥0.7 = success. 1.0 = sandbagged. 0.3 = learning (not failure, document why)
- Tie each KR to a PostHog metric — if it can't be measured, it's not a KR

**Example:**

```
O1: Become the go-to AI-native tool for nonprofit finance teams
  KR1: 5 paying nonprofit orgs by June 30 (currently 1)
  KR2: NPS ≥50 among active users (survey via PostHog surveys)
  KR3: ≤2% monthly churn (PostHog: `subscription_cancelled` events)
```

---

## Roadmap Authoring

**Format:** Now / Next / Later (no Gantt, no Jira, no sprints).

```markdown
## Roadmap — [Product] — [Quarter YYYY]

### Now (this 6 weeks — committed)
- [Feature A] — ships YYYY-MM-DD — flag: `feature_a`
- [Feature B] — ships YYYY-MM-DD — flag: `feature_b`

### Next (7-12 weeks — planned, not committed)
- [Feature C] — depends on: [A customer signal or metric]
- [Feature D]

### Later (13+ weeks — ideas, no commitment)
- [Feature E] — revisit when MRR > $X or after [milestone]
- [Feature F]

### Dropped (with reason)
- [Feature G] — dropped YYYY-MM-DD: [one sentence why]
```

**Rules:**

- "Now" items have a flag, a test, and a ship date.
- "Later" items are never designed or specced — just a name.
- Every drop is documented with reason (prevents zombie features).
- Roadmap lives at `docs/ROADMAP.md` — single source of truth.

---

## Stakeholder Management

**Who are Brian's stakeholders (solo context):**

1. Paying customers (highest weight)
2. Prospective enterprise clients
3. Domain experts / advisors (technical, legal, domain)
4. AI agents (yes — treat output consumers as stakeholders)

**Communication cadence:**

- Customers: monthly changelog email via Resend (auto-draft from `CHANGELOG.md`)
- Enterprise prospects: quarterly business review (QBR) deck using `c-suite-personas.md` § CFO/CEO voice
- Advisors: async updates in shared Notion or email — no meetings unless time-boxed to 30 min

**Escalation matrix:**

| Decision type | Who decides | Who is informed |
|---|---|---|
| Feature scope | Brian | Customers (via changelog) |
| Pricing change | Brian + CFO framework | All active customers (30-day notice) |
| Security incident | Brian + CISO framework | Affected customers (72h per GDPR/SOC 2) |
| Pivot | Brian | Advisors + investors (email, same day) |

---

## Customer Interview Synthesis

**When:** Before building anything in the "Next" bucket. Minimum 3 interviews per feature area.

**Interview guide (20 min, Jobs-to-be-Done framing):**

1. "Walk me through the last time you tried to [solve problem area]."
2. "What did you use? What frustrated you most?"
3. "If you had a magic wand, what would it do differently?"
4. "How much would you pay for a solution that did X?" (for pricing signal)

**Synthesis output (after 3+ interviews):**

```markdown
## Interview synthesis — [Feature area] — [Date]
Interviews: N | Duration: ~20 min each

### Jobs (what they're hiring the product to do)
- [Job 1]: [frequency + pain intensity 1-5]
- [Job 2]: [...]

### Patterns (heard in ≥2 interviews)
- [Quote or paraphrase]

### Outliers (heard once — flag, don't build)
- [...]

### Decision
Build: [yes/no/wait]
Why: [One sentence grounded in pattern, not outlier]
Next action: [PRD | spike | defer]
```

---
name: "non-engineering-verticals"
description: "C-suite personas, compliance OS, PM domain, and finance domain skills for enterprise client work. Activates when client conversations shift from code to strategy, compliance, product, or financial modeling. Source: alirezarezvani/claude-skills C-suite + compliance tier."
when_to_use: "Enterprise client deliverables, investor decks, PRDs, compliance audits, financial models, stakeholder comms, board-level decisions — any work that requires speaking credibly as a business operator, not just an engineer."
effort: "high"
model: "inherit"
priority: 4
pack: "business"
stage: stable
triggers:
  - "board deck"
  - "investor"
  - "PRD"
  - "OKR"
  - "compliance"
  - "GDPR"
  - "SOC 2"
  - "HIPAA"
  - "unit economics"
  - "runway"
  - "ARR"
  - "MRR"
  - "CAC"
  - "LTV"
  - "roadmap"
  - "stakeholder"
paths:
  - "business/"
  - "docs/business/"
---

# 17 — Non-Engineering Verticals

Enterprise credibility layer. Covers four domains Brian must speak fluently when serving enterprise clients: C-suite personas, compliance, product management, and finance.

## Sub-modules

- `c-suite-personas.md` — founder/CEO/CTO/CFO/CMO/CISO/GC voice + decision frameworks
- `compliance-os.md` — GDPR, SOC 2, ISO 27001, HIPAA, ADA Title II — requirements, gaps, enforcement
- `pm-domain.md` — PRD authoring, OKRs, roadmapping, customer interview synthesis
- `finance-domain.md` — unit economics, runway, SaaS metrics, pricing strategy

## Activation routing

| Signal | Sub-module | Lead voice |
|---|---|---|
| Investor ask / "board" / "deck" | c-suite-personas | CEO/CFO |
| Compliance audit / "SOC 2" / "HIPAA" | compliance-os | CISO/GC |
| Feature planning / "PRD" / "OKR" | pm-domain | CPO |
| Pricing / metrics / "runway" | finance-domain | CFO |

## Cross-links

- `rules/feature-flags.md` — SOC 2 CC6 control via flag audit trail
- `rules/ai-agent-security.md` — HIPAA / SOC 2 technical safeguards
- `rules/autonomous-engineering.md` — CISO approval tier for auth/billing/secret mutations
- `05-architecture-and-stack/` — CTO voice for architecture decisions
- `07-quality-and-verification/` — SOC 2 evidence collection via Playwright + Lighthouse CI

## When NOT to activate

- Solo personal projects — skip ceremony, ship code
- Internal tooling with no external users — compliance overhead not warranted
- Early pre-revenue prototypes — defer finance modeling until revenue signal exists