Filled preview
Illustrative example. Names, volumes, dates and outcomes are fictional; replace them with approved evidence before use.
| Question | Demo action | Caveat stated aloud |
|---|---|---|
| Can analysts retrieve evidence? | Open one exception and linked source | The pilot does not change ledger records |
| Who can access it? | Switch to restricted role | Final identity design needs approval |
| What happens on failure? | Show denied export | Incident workflow is outside the demo |
Sources: Supabase: securing data
Write the demo around questions
| Minute | Buyer question | Action shown | Proof or caveat |
|---|---|---|---|
| 0–2 | What decision is this for? | State the scoped workflow | Named evaluation criterion |
| 2–5 | Where does data go? | Show connection and boundary | Architecture or docs link |
| 5–8 | Who can do this? | Show a restricted role | Access-control evidence |
| 8–10 | What if it fails? | Show error state or explain limit | Documented behavior / open gap |
| 10–12 | What do we test next? | Confirm workload and owner | POC plan |
Sources: Supabase: securing data
Illustrative script
Illustrative example. Names, volumes, dates and outcomes are fictional; replace them with approved evidence before use.
‘Today we are deciding whether an analyst can retrieve evidence for an exception without giving the viewer write access to the ledger.’ Open with the exception list, select a record, and show the linked source file and audit entry. Switch to a restricted user and show the denied export action. Say that the test does not establish migration readiness or regional-storage compliance; those remain separate decisions. Close by asking the controller to select 30 records and the security reviewer to confirm the logging requirement.
Sources: Supabase: securing data
Demo operating rules
- Use a prepared account only when the data is explicitly suitable for the audience.
- Narrate a limitation; do not hide it behind a polished path.
- Keep a source link ready for each factual answer.
- Record follow-up questions as evidence gaps, not as promises.
Sources and dates
- Supabase: securing data ↗
Official guidance on RLS and server-side access patterns.
Reviewed 2026-09-08 - AccountMade blog: keeping buyer content traceable ↗
AccountMade blog post on keeping buyer documents traceable to their sources.
Reviewed 2026-09-08
Found an error or a changed source? Send a correction.
Apply this to your company
Draft your next buyer document from approved claims.
Briefs and decks from approved facts, every claim sourced.
See the demo →