Behavioral rubric
Calibrate scoring with clear behaviors. Use this to resolve “is this a 2 or a 3?” debates.
📌 Security
| Lvl | Behavior |
|---|---|
| 0 | No defined auth model |
| 1 | Basic auth mechanisms exist |
| 2 | Roles/permissions documented; partial enforcement |
| 3 | Standard enforcement patterns; auditing present |
| 4 | Automated validation + monitoring; playbooks exist |
| 5 | Continuous threat modeling; adaptive controls and improvement |
📌 Usability
| Lvl | Behavior |
|---|---|
| 0 | No defined user experience |
| 1 | Ad hoc UI/API design |
| 2 | Personas + UX intent documented |
| 3 | Consistent patterns and documentation |
| 4 | Measured UX outcomes; feedback loop |
| 5 | Continuous UX optimization with experiments |
📌 Maintainability
| Lvl | Behavior |
|---|---|
| 0 | Undocumented system |
| 1 | Individual conventions; fragile knowledge |
| 2 | Team conventions; partial test coverage |
| 3 | Standard patterns + regression tests |
| 4 | Pipeline-enforced quality; observability + runbooks |
| 5 | Continuous maintainability improvement |
📌 Scalability
| Lvl | Behavior |
|---|---|
| 0 | Unknown limits |
| 1 | Manual scaling; incidents teach limits |
| 2 | Partial horizontal scaling; some bottlenecks known |
| 3 | Designed scaling boundaries; backpressure patterns |
| 4 | Automated scaling policies; cost-aware scaling |
| 5 | Predictive capacity management |
📌 Availability
| Lvl | Behavior |
|---|---|
| 0 | No availability awareness |
| 1 | Basic uptime monitoring |
| 2 | SLA/SLO defined; limited redundancy |
| 3 | Redundancy patterns; graceful degradation begins |
| 4 | Automated failover; incident playbooks; error budgets |
| 5 | Proactive availability engineering; chaos/DR exercises |
📌 Durability
| Lvl | Behavior |
|---|---|
| 0 | No backups |
| 1 | Backups exist; untested restores |
| 2 | Restore steps documented; retention defined |
| 3 | Restores tested; integrity checks present |
| 4 | Automated recovery; immutable backups |
| 5 | Continuous data resilience validation |
📌 Extensibility
| Lvl | Behavior |
|---|---|
| 0 | Change requires redesign |
| 1 | Local extension points; unclear boundaries |
| 2 | Defined boundaries; contracts partially explicit |
| 3 | Versioned contracts; composition over modification |
| 4 | Event/plugin patterns; low-friction integration |
| 5 | Continuous evolutionary architecture |
📌 Portability
| Lvl | Behavior |
|---|---|
| 0 | Environment-locked |
| 1 | Manual recreation; undocumented drift |
| 2 | Partial IaC; limited repeatability |
| 3 | Reproducible environments; standard runtime |
| 4 | Automated environment mobility; data migration plan |
| 5 | Strategic mobility posture; intentional coupling |