| account | Customers manage their own identity, preferences, sessions, or deletion. | Decide which profile fields and account controls your product exposes. | Identity ownership and irreversible deletion. |
| analytics | Operators need product, revenue, usage, or credit signals. | Define decisions and metric semantics before changing charts. | Sensitive-data masking and unbounded aggregation. |
| billing | The product charges through Stripe or Lemon Squeezy. | Choose provider, enabled models, and catalog; then prove test checkout and projection. | Money, signatures, duplicate events, refunds, and entitlements. |
| branding | Owners change identity without deploying code. | Replace code defaults, then configure runtime assets and appearance. | Public uploads, metadata, and cross-surface consistency. |
| cms | Marketing or product teams publish structured content. | Choose content kinds, workflow, validation, and public routes. | Sanitized rendering, publication state, and scheduled work. |
| compliance | Operators need audit, RBAC visibility, security posture, or retention controls. | Define retention and access policies that match your legal obligations. | Admin authorization, personal data, and destructive cleanup. |
| contact | Customers or leads need an owned support/contact path. | Set recipient ownership, form fields, spam controls, and response workflow. | Public abuse, personal data, and notification side effects. |
| customers | Operators support customer and billing relationships. | Choose visible fields, filters, masks, and support actions. | Personal/financial data and growing queries. |
| docs | Your users need an in-product help center. | Replace all six starter sections with your own user workflows and support paths. | Publishing stale or internal-only instructions. |
| notifications | Business events must reach users or operators reliably. | Select events, recipients, channels, templates, and retry ownership. | Duplicate sends, secrets, privacy, and dead letters. |
| privacy | The public product uses required Google Analytics and optional attribution. | Review purposes, retention, visitor copy, and every provider script before enabling tracking. | Consent validity, third-party scripts, and regional requirements. |
| settings | Owners configure behavior without code changes. | Define safe defaults and decide whether each setting belongs in env or database. | Invalid configuration and authorization of mutations. |
| team | More than one staff member administers the product. | Define canonical roles, feature access, invite ownership, and public team visibility. | Privilege escalation and invite lifecycle. |
| waitlist | Access is staged, invite-led, or demand-tested. | Choose launch mode, captured fields, confirmation, export, and conversion path. | Public abuse, exports, and personal data. |