The exclusion that is defensible and still loses you the deal

Two boundary statements. Same company, same controls, same period, same auditor. Both narrow. Neither says anything untrue.

The first.

The Orrery production platform, and the identity and deployment systems that control access to it. The 39 people who can reach production or read customer records. Outside this boundary: the analytics add-on, which holds aggregated usage data and no customer records and runs in a separate account; the internal reporting tools; the marketing site.

The second.

The Orrery core service and its supporting infrastructure, for the period stated. Systems and functions not directly involved in delivery of the core service are out of scope pending further assessment.

Predict

A buyer's security reviewer has forty minutes and eleven vendors to get through. Which of these two costs the vendor more?

Choose one answer

The first, because it names three things that were not coveredThe second, because the reviewer cannot tell what is missing and has to assumeNeither — they are equally narrow, so they cost the sameThe first, because publishing an exclusion list gives your competitor a map

Lock in answer

Now your own version of the decision, which is harder than reading somebody else's, because the thing you want to leave out is the thing your deadline depends on leaving out.

What would you do

You sell Orrery. The production platform is in reasonable shape and the period opens in five weeks. There is also an analytics add-on: three engineers, a separate cloud account, its own database, used by about a sixth of your customers. It holds aggregated usage data — counts and timings, no customer records — and the three engineers have full access to all of it.

Bringing the add-on inside the line means a second evidence stream for every control that would claim to cover it, owned by a team of three who currently own nothing of the kind, starting in five weeks.

Optimising for

A buyer's security reviewer can tell from the boundary alone which of their own questions it answers and which ones it leaves to them.

You cannot know

• Whether the aggregated data could be re-identified by somebody who also held something else
• How many of the next twenty buyers will use the add-on at all
• Whether the three engineers would absorb the evidence work or quietly not do it
• What your largest competitor's boundary says about their equivalent component

Choose an option

Platform only. Name the add-on as outside the line, say what it holds and where it runs, and give the month you intend to bring it in.Platform only, and do not mention the add-on at all.Bring the add-on inside the line so the boundary covers the whole product.Platform only, with the add-on described as out of scope pending further assessment.

The condition under which the first option stops winning

The whole advantage of the enumerated boundary is that a reviewer can compare it with something. They have read your competitor's, they know what the normal shape is, and three named exclusions of uninteresting things reads as a company that did the work.

When the buyer has no comparable vendor to measure you against — a new category, a bespoke arrangement, the first time their procurement team has evaluated anything like you — the comparison is not available. Then enumeration reads as what it literally is: a list of three things you did not cover. Without a baseline, specific looks worse than vague, which is the one situation in which the fourth option's authors were not being lazy.

The response is to supply the baseline yourself: say what is ordinarily inside a boundary like this and where yours differs. That is more work than a sentence and it is the only thing that substitutes for a reviewer who has seen ten others.

Check

You pick the first option and publish the month you will bring the add-on in. Eleven months later it has not happened, for reasons that are entirely reasonable. What is the actual cost?

Choose one answer

A finding in the next report, because you committed to it in the boundaryEvery buyer who read the first document now has a dated promise you did not keepNothing — intentions in a scope statement are understood to be aspirationalYou have to redraw the boundary, which restarts the period

Check answer

Worth remembering

• Narrowness is not what reads as evasion; narrowness the reader cannot measure is.
• Three properties make a narrow boundary read as discipline: enumerated exclusions, each saying what it holds, and a line drawn on a predicate the reader can apply.
• An undefined residual category is priced by the reader at the worst plausible value.
• Including something you cannot evidence is more expensive than excluding something you can explain.
• Silence is the cheapest option to author and the most expensive to defend, because it moves the conversation to a moment you do not choose.
• Enumeration only reads as discipline when the reader has a baseline; without a comparable vendor, supply the baseline yourself.
• A month published in a boundary is the only part of it a non-technical reader can check later.