ValidaAuditoria
Note 05 · 24/09/2026
Every platform has a screen where everything works. It is called a demo, and it is made for that. There is nothing wrong with it — as long as no one confuses it with the product the real user finds on Monday, with their profile, their data and their connection.
Verifying a platform does not ask "does it exist?". It asks "does it work, in production, for whoever should use it — and does it not work for whoever should not?". Both halves matter. The first is exercised function by function: create the record, close it, reopen it, check that what came back is what went in. The second is tested by the negative: with a read-only role, try to write; with one project's user, try to see the other.
What exists only in a demonstration environment enters as assumed, with the access caveat: "not exercised in production". It is not an accusation against the team. It is the exact description of what was seen — and the list of what was missing: the access.
There is also what no one presents: the backup that was never restored, the key only one person has, the operator the privacy policy does not name. None of them appear in the demo. All of them appear on the day they are missing.
The product is what runs after whoever presented it has left. That is what gets verified.
