Business Blueprint

/business-blueprint

A structured walkthrough of business logic for the project type the user is building. Output is a personalized blueprint — the relevant domains for their app, the edge cases that matter, and a prioritized build plan.

When to use

• Starting a new SaaS / ERP / e-commerce / marketplace / fintech project — before committing to an architecture.
• Auditing an existing project against the full set of real-world concerns.
• Onboarding to a domain you haven't built before and want a checklist of what to think about.
• Preparing for a Series A / SOC 2 / enterprise customer review.

Operating method

1. Lock down the project type and context

Ask, in one round:

• Project type: SaaS / ERP / e-commerce / marketplace / fintech / internal tool / something else.
• Customer: B2C / SMB B2B / mid-market B2B / enterprise B2B / government / regulated industry.
• Sales motion: self-serve / freemium / sales-led / hybrid.
• Monetization: subscription / usage / transaction fee / one-time / hybrid.
• Jurisdictions (where customers and the business are): US / EU / UK / India / etc.
• Stage: pre-launch / early users / scaling / mature.
• Constraints: must-self-host, no-third-party-data, single-region, etc.

Don't blueprint without these. Domain ambiguity makes for irrelevant blueprints.

2. Walk the domain checklist for the project type

Different project types have different "must-have at v1" lists. Pick the matching section below.

SaaS blueprint

Identity & access

• Auth methods: password + magic link minimum; OAuth (Google/GitHub) for self-serve; SAML SSO for enterprise tier.
• MFA: TOTP + WebAuthn. Avoid SMS for high-value accounts.
• Roles: Owner > Admin > Member > Viewer (B2B default). Customize per domain.
• Permission model: role-based at v1. ABAC if resources need fine-grained ownership.
• Session: refresh tokens with rotation; idle timeout per security tier.
• Account merging: design how to handle "user signs up Google and SAML with same email."
• Account recovery: backup admin, recovery codes, support escalation path.

Multi-tenancy

• Isolation: shared DB + tenant_id (default for
• Customer:
• Stage:
• Jurisdictions:

Audit

| Domain | Status | Notes | |---|---|---| | Auth + MFA | Done | TOTP only; consider WebAuthn | | Multi-tenancy | Partial | tenant_id filter present; cross-tenant test missing | | Billing — failed payment | Missing | High risk for SaaS — implement before scaling | | Audit log | Missing | Required pre-SOC-2 | | …

Top 5 priorities for your stage

2. …

Build plan

• Now (this sprint):
• Soon (next 2 sprints):
• Later (post-PMF / SOC 2 prep):
• Maybe never:

Open questions for you

1. …

## Boundaries

- Don't recommend mature-stage complexity to a pre-launch project.
- Don't invent in well-trodden domains (billing, auth, search) — point at Stripe/Auth0/Algolia patterns.
- Don't overlook jurisdiction-specific compliance.
- Don't write the actual code from this skill; this is the *plan*. Implementation happens in subsequent sessions, agent by agent.
- Always cite where a recommendation comes from (Stripe Billing docs, Linear engineering blog, etc.) when borrowing patterns.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [viknesh20-20](https://github.com/viknesh20-20)
- **Source:** [viknesh20-20/claude-code-tool-kit](https://github.com/viknesh20-20/claude-code-tool-kit)
- **License:** MIT
- **Homepage:** https://viknesh20-20.github.io/claude-code-tool-kit/

Install and usage instructions live in the source repository linked above.