Shared Responsibilities: Optical Flex Full Stack

Overview

This document outlines the shared responsibilities between Optical (Platform Owner), Tenant Developers, and Agency Business Owners for Optical Flex full-stack implementations. Clear responsibility allocation ensures successful project delivery, maintains security standards, and enables efficient ongoing operations.

Important Note: Optical’s platform responsibilities (marked as R/A in the Optical column) are firm and non-negotiable as they relate to platform integrity, security, and operational stability. However, the responsibility distribution between Tenant Developers and Agency Business Owners represents Optical’s recommended approach. Business owners should assess these recommendations against their organizational structure, capabilities, and project requirements, and may adapt the responsibilities between their team and developers to better suit their specific needs.

RACI Matrix Legend

R (Responsible): The party who performs the work to complete the task
A (Accountable): The party who is ultimately answerable for the correct completion of the task
C (Consulted): The party who provides input and expertise for the task
I (Informed): The party who is kept informed about progress and decisions

Responsibility Matrix

Schema Design & Configuration

#	Task / Responsibility	Optical - Platform Owner	Tenant Developer	Agency - Business Owner
1	Design CMS Schema	C	R	A/C
2	Update CMS configs (TTL, roles, access policy)	C	R	A/C
3	Write schema & config tests	C	R	A

Frontend Development & Implementation

#	Task / Responsibility	Optical - Platform Owner	Tenant Developer	Agency - Business Owner
4	Implement frontend using schemas	I	R	A
5	Run integration & E2E tests	I	R	A/C
6	Monitor schema impact on frontend features	I	R	A/C

Platform Infrastructure Management

#	Task / Responsibility	Optical - Platform Owner	Tenant Developer	Agency - Business Owner
7	Provision CMS environments	R/A	I	I
8	Manage CMS infrastructure and upgrades	R/A	I	I
9	DR Exercise (Backup and Restore Testing)	R/A	-	I

Content Management

#	Task / Responsibility	Optical - Platform Owner	Tenant Developer	Agency - Business Owner
10	Create and update content	-	I	R/A

Security & Compliance - Public Web

#	Task / Responsibility	Optical - Platform Owner	Tenant Developer	Agency - Business Owner
11	VA (Public Web)	I	R	A/C
12	PT (Public Web)	I	R	A/C
13	Apply security patches (Public Web)	I	R	A/C
14	Cloud SSP for agency website	I	C	R/A

Security & Compliance - Platform Infrastructure

#	Task / Responsibility	Optical - Platform Owner	Tenant Developer	Agency - Business Owner
15	VA (CMS & infra)	R/A	-	-
16	PT (CMS & infra)	R/A	-	-
17	Apply security patches (CMS & infra)	R/A	-	-

Legend: VA = Vulnerability Assessment, PT = Penetration Testing, DR = Disaster Recovery, SSP = System Security Plan

Feature Comparison: Basic vs Flex

VICA