Lines of questioning — Discovery technical

Point 9 — Create a secure service which protects users' privacy

Ask:

• What personal data does the current process collect, and where is it stored (systems, inboxes, spreadsheets, supplier platforms)?
• Who is it shared with, including other departments and suppliers, and on what basis?
• Which of those stores would a new service be tempted to copy, and why should it not?
• What do you not yet know about retention and access?

Evidence to request: a data-flow sketch of the current estate, a list of sharing partners, any existing DPIA for the legacy service. A new DPIA for an unbuilt system is not required.

Answers that indicate Met: the team can point at a messy data store and say why it is risky.

Answers that indicate Not Met: "security will be designed in Alpha", or Discovery has already stood up a new database of real user data.

Point 11 — Choose the right tools and technology

Ask:

• Which legacy systems does this journey touch, and what are the interface constraints (API, batch file, terminal, manual rekey)?
• Where are the data silos, and who is allowed to change them?
• What contractual or licensing lock makes a later exit expensive?
• What have you explicitly refused to decide until Alpha?

Evidence to request: a context diagram of current systems, notes from the owning teams, contract constraints. Production Terraform, a draft component library, and a "schema v1.0" are not Discovery evidence. They fire red line D1.

Answers that indicate Met: constraints are specific ("the register is a nightly flat file owned by another agency") and no target stack has been chosen.

Answers that indicate Not Met: the pack contains production infrastructure-as-code, application code, or a schema the team calls version 1.0. Call this premature architecture. The team is still in the problem space. They should not write production code.

Point 13 — Use open standards and common platforms

Ask:

• Which of One Login, Notify, Pay, Forms, and the Design System might this journey need, and what is unknown about each?
• What identifiers, data standards, or registers does the estate already use?
• Has anyone committed to a custom identity, payments, or messaging build? If so, why this early?

Evidence to request: a short options note that lists platforms to test in Alpha. A custom build does not belong here.

Answers that indicate Met: platforms are named as questions for Alpha, not as repositories already created.

Answers that indicate Not Met: a common platform has already been replaced by new code.

Premature-build probe

If you see production AWS Terraform, a React component library, or a versioned schema, stop the rest of the interview long enough to record D1. Then continue only to understand how far the commitment has spread. Do not help them improve the production code.