# Data and access worksheet

Use fictional records for course exercises. Get a policy review before using real customer data.

## Fields
| Field | Purpose | Source | Sensitivity | Who can read it | Retention/deletion |
|---|---|---|---|---|---|
| Name | | | | | |
| Contact | | | | | |
| Selected service | | | | | |

## Access matrix
| Role | Read own records | Read others | Create | Edit/delete | How to test denial |
|---|---:|---:|---:|---:|---|
| Guest | | | | | |
| Signed-in owner | | | | | |
| Another user/tenant | | | | | |

## Secrets and integrations
- Required keys:
- Where server-side secrets are stored:
- What may be exposed to the browser:
- Fields that must not be logged:
- User-visible behavior if an integration fails: