# Functional Design Plan — U3 HTTP Security Headers & CSP

**Unit**: U3 HTTP Security Headers & CSP
**Round**: R2 (with U4 Observability)
**Requirements**: FR-18
**Components**: C-01, C-02, C-03, U3 portion of C-16

**Scope boundary**: this stage designs *behaviour* — which headers apply to which response, what each policy permits, and what happens in edge cases. The *pattern* decisions (how the policy is composed, how the configuration surface is shaped) belong to this unit's NFR Design, which follows.

---

## Step 1: Analyze unit context
- [x] Read the U3 definition from `unit-of-work.md`
- [x] Read FR-18 and D-31 from `requirements.md`
- [x] Read the per-header scoping decision (FU1 = A) and the configuration split (FU2 = A)
- [x] Confirm the settled path layout from U1 as delivered

## Step 2: Design header applicability
- [x] Define which headers apply to all responses and which to HTML only
- [x] Define behaviour for redirects, `304 Not Modified` and error responses
- [x] Define behaviour when a header is already present
- [x] Define whether headers apply in Development — see Question 3

## Step 3: Design the two policies
- [x] Define what the `Strict` policy permits for `/admin` and `/api/v1` — see Question 1
- [x] Define what the `Relaxed` policy permits for the public website — see Question 2
- [x] Define how the Umami and Sentry origins enter the policy
- [x] Define behaviour for the placeholder page

## Step 4: Design failure behaviour
- [x] Define startup behaviour on an unknown policy name
- [x] Define behaviour when no origins are configured
- [x] Confirm header application never throws into the response path

## Step 5: Define business rules
- [x] Enumerate applicability rules
- [x] Enumerate policy-content rules
- [x] Identify error and edge-case scenarios

## Step 6: Generate artifacts
- [x] Generate `business-logic-model.md`
- [x] Generate `business-rules.md`
- [x] Generate `domain-entities.md`
- [x] Validate all diagrams against the Mermaid standards
- [x] Verify Security Baseline compliance for this unit's design