# PRD · MVP 1 · Policy answers with citations

*Specimen: real structure, dummy content. The product, the library service and every number on this
page are invented to show how the document is filled in. † marks a dummy value.*

**Header block:** product · *Library staff assistant* · MVP 1, *Policy answers with citations* ·
version 1.2 · 2026-05-04 · owner: product manager · status: **approved** · links: master spec MVP 1,
eval framework v1, success metrics v1

## 1 · Problem statement
- **Branch staff** answer patrons' questions about loans, fines, room bookings and membership from a
  policy handbook of 140† pages that changes every month.
- **The number:** a staff survey found a typical policy look-up takes 6 minutes† and one answer in
  eight† given at the desk contradicts the current handbook. Source: staff survey, 2026-02†.
- **Today:** staff ask a colleague, search a shared drive, or ring the policy team, which takes 30†
  calls a week.

## 2 · Scope and non-goals
### In scope (this MVP)
- Answer a staff member's policy question in plain language, citing the handbook section it rests on.
- Abstain, saying so plainly, when the handbook has no answer.
- Show the handbook version an answer was drawn from.

### Non-goals (binding)
- **No patron records.** The assistant never reads loans, fines or contact details of any patron.
  Declined risk R-03: personal data in the index (DPDP Act, India; GDPR where it applies).
- **No patron-facing use.** Staff only; a patron never types into it.
- **No changes to the handbook or the catalogue.** It reads; it never writes.
- **No answers from outside the handbook**, even when a general answer would be right.

## 3 · Actors
| Actor (by role) | Goal | Trust level | Negative case (what they must not be able to do) |
|---|---|---|---|
| Branch staff member | A correct, cited answer at the desk | Staff sign-in | Retrieve any patron's personal data |
| Branch manager | See which questions are asked and which abstain | Staff sign-in, manager role | Edit an answer after it was given |
| Policy team member | Publish a handbook version and see it indexed | Content-owner role | Publish without a version number |
| **Negative persona:** a caller posing as staff | Learn another patron's loans or address | None | Get anything but a refusal |

## 4 · User stories with acceptance criteria
### Capability group A · Answer with a citation
- **A-1** As a branch staff member I want to ask a policy question in my own words so that I can answer
  a patron without leaving the desk.
  *Accepted when:* the answer names at least one handbook section; the section exists in the current
  version; the answer appears within the latency target NFR-1. *Eval case:* E-CIT set.
- **A-2** As a branch staff member I want to see which handbook version the answer used so that I know
  it is current. *Accepted when:* the version string is shown and matches the indexed version.

### Capability group B · Abstain and refuse
- **B-1** As a branch staff member I want the assistant to say "the handbook does not cover this" when it
  does not, so that I do not repeat a guess. *Accepted when:* abstention target NFR-3 is met on the
  unanswerable set. *Eval case:* E-ABS set.
- **B-2** As the policy team I want any request for a patron's personal data refused so that staff
  cannot be talked into a disclosure. *Accepted when:* every case in the refusal set is refused.
  *Eval case:* E-REF set.

### Candidate stories: surfaced, not committed
- Answer in a second language at the desk (heard in two† branch visits).
- Suggest a handbook edit where staff often get no answer.

## 5 · Functional requirements
| ID | Requirement | Story it serves | Verification (test, demo, inspection) |
|---|---|---|---|
| FR-1 | Retrieve handbook passages by meaning and by exact phrase, fused into one list | A-1 | Test |
| FR-2 | Every answer carries one or more section citations that resolve | A-1 | Test + eval |
| FR-3 | Display the indexed handbook version on every answer | A-2 | Demo |
| FR-4 | Return a fixed abstention message when no passage clears the threshold | B-1 | Eval |
| FR-5 | Refuse requests that name or describe a patron | B-2 | Eval |

## 6 · Non-functional requirements
| ID | Dimension | Target | Measured how | Measured when (before sign-off) |
|---|---|---|---|---|
| NFR-1 | Latency | P50 ≤ 1.5 s†, P95 ≤ 4.0 s† | Timed run of the gate set on the staging stack | Phase 4 exit check |
| NFR-2 | Citation validity | 100 %† of citations resolve to a section in the indexed version | Gate script over 60† cases | Every gate run |
| NFR-3 | Abstention | ≥ 95 %† on 40† unanswerable questions | Gate script | Every gate run |
| NFR-4 | Refusal | 100 %† on 25† patron-data requests | Gate script | Every gate run |
| NFR-5 | Data residency | Index, logs and model run in-country | Inspection of the deployment | Phase 5 |
| NFR-6 | No personal data in the index | Zero patron fields in the indexed corpus | Field scan of the index | Every re-index |
| NFR-7 | Availability | 99.5 %† during opening hours | Uptime monitor over 30† days | Before MVP 1 sign-off |

## 7 · Metrics hook
- **KPI moved:** median time to a cited answer at the desk, from 6 min† to ≤ 1 min†.
- **Guardrail metric:** calls to the policy team must not rise while the KPI improves.
- **Eval floor to clear:** NFR-2, NFR-3, NFR-4, as pinned in eval framework v1 §5.

## 8 · Open questions and risks
| ID | Question or risk | Owner (role) | Decision needed by | Register reference |
|---|---|---|---|---|
| Q-1 | Do superseded handbook versions stay searchable? | Policy team lead | Phase 2 spec | — |
| R-01 | Answer cites a section from a superseded version | Product manager | Phase 3 | Risk register R-01; LLM09 |
| R-03 | Personal data reaches the index | Product manager | Declined in scope | Risk register R-03; LLM02 |

## 9 · Traceability appendix
| Story | Functional reqs | NFRs | Eval cases | Test IDs | Sign-off entry |
|---|---|---|---|---|---|
| A-1 | FR-1, FR-2 | NFR-1, NFR-2 | E-CIT-01 … 60† | T-RET-*, T-CIT-* | SO-03 |
| A-2 | FR-3 | — | — | T-VER-01 | SO-03 |
| B-1 | FR-4 | NFR-3 | E-ABS-01 … 40† | T-ABS-* | SO-04 |
| B-2 | FR-5 | NFR-4 | E-REF-01 … 25† | T-REF-* | SO-04 |

---
*What is real here: the nine sections, the binding non-goals, the negative persona in the actor table,
NFRs declared as numbers with a measurement point, and the traceability from story to sign-off entry.
Everything inside the sections is invented.*