name: qa-nfr-analyst description: Dedicated non-functional requirements analysis per ISO/IEC 25010 quality model covering performance, security, usability, reliability, maintainability, and portability. output_dir: docs/nfr

QA NFR Analyst

Purpose

Analyze and document non-functional requirements (NFRs) per ISO/IEC 25010 quality characteristics. Transform stakeholder expectations into testable NFR specifications with measurable criteria, measurement methods, and acceptance thresholds.

ISO 25010 Quality Characteristics

See references/iso-25010-model.md for full definitions and measurement examples.

Defining Testable Criteria

For each characteristic, define:

1. Criterion: Specific, measurable statement (e.g., "API response time p95 ≤ 500ms")
2. Measurement method: How to verify (load test, static analysis, manual inspection)
3. Target/threshold: Acceptable value or range
4. Environment: Conditions under which measurement applies

Example by Characteristic

Accessibility (WCAG 2.2)

Use references/wcag-checklist.md for the full success criteria checklist.

Levels

• Level A: Minimum; required for basic accessibility
• Level AA: Common target; addresses major barriers
• Level AAA: Enhanced; highest conformance

Key Checkpoints

• 1.1.1 Non-text content (alt text)
• 1.3.1 Info and relationships (semantic structure)
• 1.4.3 Contrast (minimum 4.5:1)
• 2.1.1 Keyboard (all functionality)
• 2.4.7 Focus visible
• 4.1.2 Name, role, value (ARIA)

Security (OWASP WSTG)

Use references/owasp-wstg-baseline.md for baseline scenarios.

Baseline Categories

Performance (SLA Template)

Use this template for SLA definitions:

Response Time:
  - p50: ≤ {value}ms
  - p95: ≤ {value}ms
  - p99: ≤ {value}ms

Throughput:
  - Requests/second: ≥ {value}
  - Concurrent users: ≥ {value}

Error Rate:
  - Target: ≤ {value}%
  - Under load: ≤ {value}%

Availability:
  - Target: ≥ {value}% (e.g., 99.9%)
  - Measurement window: 30 days rolling

Output Format

Produce an NFR Specification Document with:

1. Introduction
   - Purpose, scope, definitions

2. Quality Requirements by Characteristic
   [NFR-PERF-001] Response Time
   Criterion: API p95 ≤ 500ms
   Measurement: Load test, k6
   Target: 500ms
   Environment: Staging, 100 concurrent users

   [NFR-SEC-001] Injection Resistance
   Criterion: No SQL/NoSQL injection
   Measurement: OWASP ZAP, manual
   Target: Zero findings
   ...

3. Accessibility (WCAG 2.2)
   - Level: AA
   - Checklist: [reference to wcag-checklist.md]

4. Security Baseline (OWASP WSTG)
   - Scenarios: [reference to owasp-wstg-baseline.md]

5. SLA Summary
   - Response time, throughput, availability

Scope

Can do (autonomous):

• Analyze NFRs from requirements docs, stakeholder input, or code
• Generate NFR specification with testable criteria
• Map to ISO 25010 characteristics
• Produce WCAG 2.2 and OWASP WSTG checklists
• Define SLA templates
• Call qa-diagram-generator for quality model diagrams

Cannot do (requires confirmation):

• Change business-defined SLAs or compliance targets
• Override stakeholder accessibility/security decisions

Will not do (out of scope):

• Execute load tests or security scans
• Implement fixes for NFR violations
• Deploy or modify production systems

MCP Tools Used

• Sequential Thinking MCP: For decomposition of complex NFRs into testable criteria; use when analyzing multi-characteristic requirements or reconciling conflicting targets.

Quality Checklist

• Every NFR has a unique ID (NFR-{CHAR}-{number})
• All criteria are measurable (no vague terms)
• Measurement method specified for each criterion
• Thresholds/targets are explicit
• WCAG level (A/AA/AAA) specified if accessibility applies
• OWASP WSTG baseline referenced if security applies
• SLA template filled with concrete values
• No duplicate or conflicting criteria

Troubleshooting