Sprint board - Card D&A platform

Epics with acceptance criteria (Given / When / Then). 8 stories.

IngestionEntitlementsGold ProductsMLGen-AIGovernance

Backlog0

To Do2

Governance3pt

SR 11-7 model register

As model risk I track every model's lifecycle stage and validation status.

AC: Given the governance register, Then each model shows SR 11-7 stage, last validation, fairness status, owner.

Sprint 25

Ingestion8pt

Nova bronze landing

As data eng I land Nova auths immutably for replay.

AC: Given a Nova auth batch, Then it appends to bronze with full fidelity and lineage to gold.

Sprint 25

In Progress2

ML8pt

Adverse-action reason codes

As a declined cardholder I get accurate decline reasons (Reg B / CFPB 2022-03).

AC: Given a model decline, Then top SHAP features map to a plain-language adverse-action reason.

Sprint 25

Gen-AI5pt

Guardrail NL-to-SQL

As a platform owner I ensure NL queries cannot mutate or escape the schema.

AC: Given any generated SQL, Then only single-statement SELECT on atlas runs, under RLS, with a row cap + timeout.

Sprint 25

In Review1

Gold Products3pt

Publish card_transactions_gold contract

As a consumer I can read the data contract before I build on the product.

AC: Given the product detail page, Then the field-level contract (type, PII flag, SLA, allowed roles, purpose) renders.

Sprint 25

Done3

Entitlements5pt

Row-scope partner analysts

As a Partner Nova analyst I only see Nova rows so partner data stays isolated.

AC: Given role partner_analyst_nova, When I query card_transactions_gold, Then only partner_scope=nova rows return and the row count reflects it.

Sprint 24

Entitlements5pt

Purpose-based fraud unlock

As a fraud analyst I see confirmed-fraud detail only under the Fraud Prevention purpose.

AC: Given purpose != fraud_prevention, When I query, Then is_fraud rows are hidden; Given fraud_prevention + fraud role, Then they appear.

Sprint 24

Entitlements3pt

Mask PII by default

As any non-privileged role, contact PII and account tokens render masked.

AC: Given a role without can_unmask_pii, When I read customer_360, Then email/phone are masked and the audit row records masked=true.

Sprint 24