# W/ Founders — Participant Workbook

## Decision requested

_What exact decision is requested, by when, from whom, and what can this room not conclude?_

## Fictional case facts

- [ ] **FACT-01** — The company-controlled checkout route and production DNS are live.
- [ ] **FACT-02** — Provider-hosted fields are embedded in the checkout page; the provider receives entered payment data directly.
- [ ] **FACT-03** — The checkout page, script policy, deployment pipeline, and production configuration remain company-controlled.
- [ ] **FACT-04** — A public callback hostname terminates at a company-managed gateway and invokes company application code.
- [ ] **FACT-05** — Two founders hold production administrator roles; one role can change checkout configuration and callback secrets.
- [ ] **FACT-06** — A feature flag can expose checkout to customers without a new deployment.
- [ ] **FACT-07** — Live provider credentials and callback configuration are present in the production environment.
- [ ] **FACT-08** — Only staging transaction behavior has been exercised end to end.
- [ ] **FACT-09** — The provider assurance packet names a hosted-field service, but the customer responsibility row is incomplete for script and callback operation.
- [ ] **FACT-10** — The founders assert that PCI DSS begins after the first successful customer payment.
- [ ] **FACT-11** — The current external scan and penetration-test populations do not identify the callback termination.
- [ ] **FACT-12** — Support wants a session-replay script added to the checkout shell before launch to diagnose abandonment.

## Capability-state starting ledger

| Capability | Proposed | Present | Production-capable | Effective | Stopping question |
| --- | --- | --- | --- | --- | --- |
| Customer checkout route |  | ✓ | ✓ |  | What exact event makes the route available to a customer? |
| Provider-hosted payment collection |  | ✓ | ✓ |  | Which deployed configuration and service mode define the current provider relationship? |
| Public payment callback |  | ✓ | ✓ |  | Which hostname, gateway, code revision, secret, and test population describe it? |
| Founder production administration |  | ✓ | ✓ | ✓ | What can each role change, invoke, approve, export, or cause another system to do? |
| First-transaction monitoring |  | ✓ | ✓ |  | Which expected events and failures are observable before the first customer arrives? |
| Incident and support response |  | ✓ |  |  | Who can act, with what access and retained evidence, during a payment failure? |
| Production evidence runway |  | ✓ |  |  | Which required operating histories cannot exist until time and occurrences accumulate? |
| Checkout session replay | ✓ |  |  |  | What can the script observe or influence, and which prior boundary claims must reopen? |

## Two-path boundary map

| Subject | Relationship | Account Data Or Influence | Owner | Evidence | Unknown |
| --- | --- | --- | --- | --- | --- |
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |

## Provider responsibility brief

| Service | Provider Activity | Customer Activity | Assurance Source | Implementation Evidence | Conflict | Reverification Event |
| --- | --- | --- | --- | --- | --- | --- |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |

## First-transaction evidence runway

| Evidence Event | Before Launch | First Transaction | Recurring Occurrence | Period Required | Owner | Retention |
| --- | --- | --- | --- | --- | --- | --- |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |

## Final decision and reopening record

| Decision Requested | Current Facts | Decision | Conditions | Owner | Limitations | Reopening Triggers |
| --- | --- | --- | --- | --- | --- | --- |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |

## Boundary

W/ Founders is independent practitioner education using a fictional company and fictional facts. It is not PCI SSC guidance, not an assessment, not a compliance result, not an SAQ-selection or eligibility decision, not legal or investment advice, not launch approval, not provider certification or endorsement, and not direction from a compliance-accepting entity. It does not authorize testing. Never enter account data, credentials, provider secrets, client evidence, restricted architecture, customer information, investor information, or identifying startup facts.