Security requirements that cannot be tested are not finished

Do not begin with the library. Begin with what the attacker can do and what the product must prevent or contain.

An acceptance criterion might say that a copied application database cannot reveal an active refresh token, or that a logged-out device cannot reuse cached authenticated content. Both statements can be tested. "Use secure storage" cannot.

Security mechanisms fail in production. Attestation is unavailable. A key is invalidated. The network cannot reach the refresh service. A migration meets data written by an older version.

The requirement must say whether the product blocks, degrades, retries, clears state or asks the user to authenticate again. If the failure mode is unspecified, the implementation will invent it under pressure.

Take logout. Local sign-out and server-session invalidation are two obligations, and a cleared screen proves neither.

Once local sign-out completes, a refresh started under account A must not write credentials or screen state into any later session. Whether the server session was invalidated is reported separately.

This is the part of a token manager that enforces it. Logout bumps a generation and drops the in-flight refresh. A late response can commit only if its generation, its flight and its account still match.

public func logout() throws {
    generation += 1
    flight?.task.cancel(); flight = nil
    try store.replace(nil)
    credentials = nil
}

private func commit(_ next: Credentials, account: String, epoch: Int, id: UUID) throws -> Credentials {
    guard generation == epoch, flight?.id == id, credentials?.accountID == account else {
        throw SessionError.invalidated
    }
    guard next.accountID == account else { throw SessionError.wrongAccount }
    try store.replace(next)
    credentials = next
    flight = nil
    return next
}

The order is deliberate. The generation bump comes first, so a late response is already rejected while the store write runs. Memory clears only after the store write succeeds: if the write throws, logout reports the failure and the caller can retry instead of showing a signed-out screen over credentials still on disk.

The test that matters uses a refresh client that ignores cancellation, because cancellation alone would let its late response through. A test like this checks that a late response after logout cannot restore credentials, and a negative control that removes the guard must make the logout test fail. Keychain behaviour on a physical device, backup and reinstall, and server-side invalidation stay on the release gate until someone runs them.

A passing unit test may prove that a wrapper called an API. It does not prove that sensitive data stayed out of logs, backups, screenshots or analytics payloads.

Choose evidence that reaches the boundary you claim to protect. That may include an integration test, a device inspection, a proxy capture, a release configuration check or a documented manual verification.

Threats, platform behaviour and dependencies change. A control without an owner becomes a historical belief.

Record who reviews the requirement, which event forces a new review and which evidence the release must retain. The result is a behaviour the product team can operate.