Using Plan mode with PRDs

Plan mode only, do not edit files or run commands.

We are building <one-sentence product idea>. Target users: <role>. Constraints: <stack, compliance, timeline if any>.

Write a full PRD in markdown, ready to save as docs/acme-feature-prd.md. Include: summary, problem, goals, non-goals, user personas, user stories (As a / I want / So that), functional requirements (numbered), non-functional requirements, success metrics, rollout phases, risks, open questions. Use ## headings. Be specific enough that engineering could estimate without inventing scope.

Same PRD. Strengthen non-goals (what sales will ask for that we refuse in v1). Add measurable acceptance criteria for the top three user stories. Flag any goal that conflicts with a non-goal.

# PRD: Inactive seat reclamation & license visibility

**Owner:** Product Platform  
**Status:** Draft for eng review  
**Last updated:** 2026-04-20  

## Executive summary

**Northwind Analytics** sells per-seat subscriptions. Finance and IT admins lack a **trustworthy** view of **who has not used the product in 90 days**, and reclaiming seats today is a manual CSV export plus spreadsheet. We will ship an **admin-only** workflow to **identify**, **notify**, and **reclaim** inactive seats with a clear audit trail, without deleting user data by default.

## Problem statement

- CS and IT spend **~4 hours per month per large account** reconciling license counts with real usage.
- Admins **over-buy** seats because they cannot prove which logins are dormant.
- **Surprise churn** occurs when customers discover unused seats only at renewal, perceived as “gotcha” pricing if we do not give **advance visibility**.

## Goals

1. **Visibility:** Org admins can see **last activity date** per licensed seat and filter **inactive ≥ 90 days** (configurable per org, default 90).
2. **Action:** Admins can **mark seats for reclamation**, triggering **email** to the affected user and **grace period** (default 14 days) before the seat returns to the pool.
3. **Audit:** Every reclamation event is **immutable** in the org audit log: actor, target user, prior state, timestamp, optional admin note.
4. **Trust:** No automatic **hard delete** of user content in v1; reclaimed seats **lose app access** but **data remains restorable** by support for **30 days** (policy text in-app).

## Non-goals (v1)

- **Self-service** for end users to “give up” their own seat (admin-only).
- **Billing integration** that automatically reduces invoice line items; finance gets **export only**.
- **Mobile app** specific UX; web responsive is enough.
- **Cross-org** analytics or benchmarking against other customers.
- **ML-based** prediction of churn or “likely inactive”, rule is **purely time since last meaningful activity**.

## Personas

| Persona | Needs |
| --- | --- |
| **Org IT admin (primary)** | Reclaim seats before true-up; prove usage to leadership. |
| **CSM (secondary)** | Gentle nudge to customer admins before renewal; no manual SQL. |
| **Affected end user** | Clear email: what happened, how to request access again, data retention note. |

## User stories

1. **As an** org admin, **I want** to filter members by “last activity > 90 days” **so that** I can target reclamation candidates.
2. **As an** org admin, **I want** to select multiple users and start a reclamation workflow **so that** I do not repeat the same clicks per person.
3. **As an** org admin, **I want** to set org-level **grace period** (7–30 days) **so that** legal/compliance can match our offboarding policy.
4. **As an** affected user, **I want** one email with **plain language** and a **support link** **so that** I understand I lost access but my exports still exist per policy.
5. **As a** CSM, **I want** a **read-only** report URL (time-bounded token) **so that** I can show the customer admin inactive users without admin login.

## Functional requirements

1. **Activity definition:** “Meaningful activity” = successful **login** OR **any mutating API call** OR **export** action; **not** passive page loads of the marketing shell.
2. **Filters:** Last activity date, role, team, **never logged in**, **scheduled for reclaim**.
3. **Bulk actions:** Max **500** users per batch; show progress and **partial failure** list if some users are **super-admins** or **legally protected** (flagged in HRIS sync, see open questions).
4. **Email:** Use existing **transactional** provider; template versions **v1** stored in repo; **unsubscribe** does not apply (account-security email class).
5. **Reclaim state machine:** `active` → `pending_reclaim` (grace) → `reclaimed` → optionally `restored` by support within 30 days.
6. **Permissions:** Only **org_admin** and **billing_admin** roles may initiate reclaim; **viewer** role read-only on reports.

## Non-functional requirements

- **Performance:** Inactive filter on **10k** members returns in **< 3s** p95 (existing read replica OK).
- **Accessibility:** Admin tables meet **WCAG 2.1 AA** for sortable columns and status badges.
- **Localization:** **EN only** v1; strings in resource files for **FR in v1.1**.

## Success metrics

- **Adoption:** ≥ **40%** of enterprise accounts with **> 50 seats** run the inactive filter **once** within **60 days** of launch.
- **Efficiency:** Median time from “open admin” to “first reclaim batch submitted” **< 10 minutes** (instrumented funnel).
- **Support:** ≤ **5%** of reclamation actions generate a **priority** ticket in first month (baseline TBD).
- **Trust:** **Zero** P0 incidents related to **wrong user** reclaimed (measured via audit + support tags).

## Rollout

1. **Internal dogfood** (1 week), feature flag `seat_reclaim_internal`.
2. **Private beta**: **10** orgs opt-in; CSM playbook required.
3. **GA**: default **on** for Enterprise; **off** for Standard until pricing review.

## Risks & mitigations

| Risk | Mitigation |
| --- | --- |
| **Wrong person** reclaimed | Confirmation modal with **avatar + email**; undo within grace; audit. |
| **Legal hold** users | **Open:** HRIS “do not touch” flag, block with clear error. |
| **Email deliverability** | Reuse **existing** verified domain; staging sends to **mail catcher** only. |

## Open questions

1. Who owns **super-admin** reclaim, allowed or **always blocked**?
2. **API** for partners to ingest reclaim events in v1 or **CSV export only**?
3. **EU residency:** Does audit log for this feature need **region pinning**?

## Document history

| Date | Author | Note |
| --- | --- | --- |
| 2026-04-20 | PM draft | Initial Plan mode output before eng review |

@docs/acme-feature-prd.md
@docs/acme-feature-plan.md

Complete only the next unchecked item in the plan. If the plan conflicts with the PRD non-goals, stop and quote both sections. When done, mark the checkbox and summarize.