Phase 1 Business Context

Phase 1: Business Context Analysis

Objective

Understand what the system does, who it serves, and what's at stake if it's compromised. This phase sets the foundation for all subsequent analysis.

Tools Reference

manage_system_context (primary tool)

This single tool manages business context plus software, data asset, user persona, and NFR profiles. Call action="describe" for a section before writing it when you need its exact fields and enum values. Use action="set", section="all" to submit the complete Phase 1 context in one nested payload.

The business fields below live inside values["business"]. All are required for action="validate", section="all" to return PASSED for business context.

The 11 scalar features plus the four geographic facets (counted together as geographic_profile) make up the 12 features the completeness check requires.

Example:

manage_system_context(
  action="set",
  section="all",
  values={
    "business": {
      "description": "Payment processing service for an e-commerce platform",
      "industry_sector": "Finance",
      "sensitivity_tier": "Restricted",
      "user_base_size": "Large",
      "geographic_scope": "Global / Transboundary",
      "regulatory_requirements": ["PCI-DSS", "GDPR"],
      "system_criticality": "High",
      "financial_impact": "High",
      "authentication_requirement": "MFA",
      "deployment_model": "PaaS",
      "user_base_metric": "Monthly Active Users",
      "revenue_band": "Mid-market",
      "data_residency": "National / Single-Country",
      "compute_location": "Regional / Multi-Country Bloc",
      "user_base_location": "Global / Transboundary",
      "organizational_headquarters": "National / Single-Country"
    },
    "software": {"software_type": "API Service", "deployment_model": "PaaS"},
    "data_assets": [{"name": "Cardholder data", "structural_category": "Structured Data", "sensitivity_tier": "Restricted"}],
    "user_personas": [{"name": "Customer", "persona_type": "Authenticated Standard User"}],
    "nfrs": [{"quality_class": "Availability", "level": "99.9%"}]
  }
)

Other Phase 1 Tools

• manage_system_context(action="describe", section=SECTION) -- Exact fields and enum values on demand
• manage_system_context(action="get", section="all") -- Review business context and every profile
• manage_system_context(action="plan", section="business") -- Get detailed business-analysis guidance
• manage_system_context(action="validate", section="all") -- Check the business gate and report profile coverage
• manage_system_context(action="clear", section=SECTION) -- Clear one section or all context
• manage_workflow(action="set_project", directory=PROJECT_DIRECTORY) -- Record the project path used to decide whether Phase 7.5 applies
• manage_assumptions(action="add", values=ASSUMPTION) -- Document scope decisions

The software, data_assets, user_personas, and nfrs sections hold the classification profiles. They are required by the agent workflow, but they are not inputs to the server's Phase 1 completion gate.

Workflow

1. Record the project path with manage_workflow(action="set_project", directory=PROJECT_DIRECTORY)
2. Read the codebase: Examine README, config files, package manifests, and infrastructure code
3. Determine context: What does the system do, who uses it, and what data does it handle?
4. Describe sections as needed with manage_system_context(action="describe", section=SECTION)
5. Set the complete context once with action="set", section="all"
6. Validate with action="validate", section="all"; business context must pass
7. Document assumptions with manage_assumptions(action="add", values=ASSUMPTION) for scope decisions such as regional limits or peak-load expectations
   • "Peak load is 10x normal during sales events" (affects availability)

Completion Criteria

• manage_system_context(action="validate", section="all") returns PASSED for business context
• All 12 required business features set, including all four geographic facets
• Project directory recorded
• Software, known data asset, user persona, and relevant NFR profiles recorded
• Key assumptions documented
• Call manage_workflow(action="advance") to proceed to Phase 2

Common Pitfalls

• Setting only the description without the 12 required features
• Guessing regulatory requirements without analyzing the data types
• Not documenting assumptions that limit scope