So I am defining FRs for my use case say (Place order) "to place order the user has to be logged in"

The login process is a NFR but the FRs depend on this NFR, so how do I list that?

SFRs for Use case: Place order
SFR1 - User wants to place order
Fit criteria: Order page is displaced
- -- - - At this point the system shall check if the user is signed in or not. How should I show this Non-FR?

  • 3
    I believe you have a conceptual confusion between a non functional requirement and a task to deliver a specific functional request. NFRs are usually related to how the platform (and not the application) should behave (with parameters like performance, volumes, resiliency, etc)
    – Tiago Cardoso
    Commented Apr 13, 2018 at 7:21
  • Why do you think checking for authorization is NFR? It is a function.
    – Alexey R.
    Commented Apr 13, 2018 at 9:28
  • 1
    Oh, I was reading through some documentation and it mentioned security as a non-functional.
    – SANM2009
    Commented Apr 13, 2018 at 10:28
  • Partly it is non-functional, but as you see here, certain functionality may be present in the system for security reasons. It's reasonable to call a requirement to log in a functional requirement. Commented Apr 19, 2018 at 9:05

1 Answer 1


What's included in the FRs is dependent on the purpose of your task, but it's acceptable to have permissions defined in your use cases, given users need different types of access and functionality based on their roles.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.