Add: requirements for disabling accounts, killing sessions

1 files changed, 5 insertions, 0 deletions

diff --git a/yuck.mdwn b/yuck.mdwn
index 7f46226..7908b01 100644
--- a/yuck.mdwn
+++ b/yuck.mdwn
@@ -175,6 +175,11 @@ reference in discussions.
 * (ACLTRY) There must be a way to test ACL rules: if *this* user in
   *these groups* does *this* operation for *this* resource, is it
   allowed? This may require additional support from the RP.
+* (DISABLEACCT) It must be possible to disable an account (whether for
+  an end-user or an API client) so that it still exists, but
+  authentication cannot ever succeed.
+* (KILLSESSION) It must be possible to kill existing web sessions to
+  kick out someone who is logged in to Yuck.
 
 
 # Architecture: the ecosystem