I'm familiar with the concept of technical debt as the cost of effort (through maintenance, support, rework etc.) incurred when choosing an expedient solution over a complete one.
What I am wondering about is, is technical debt incurred for any choice you make?
Take for example securing an existing application that never had any security previously. Imagine that initially the requirement is simple enough - there are admins and non-admins. Admins can access the admin area and non-admins cannot. At this point the team has a choice,
- implement a simple security model e.g. a field indicating whether a user is an admin or not and restricting application access on this field or
- implement a complete security model e.g. roles, permissions and groups and associated application hooks.
The costs attached to the implementations are:
- the simple model. quick to implement (5d), but the cost of adding and managing additional roles e.g. supervisor, manager etc. and applying them throughout the application is expensive (5d per role)
- the complete model. longer to implement (20d), but the cost of adding additional roles should be minimal and the cost of applying them throughout the application is lower than the simple option (1d per role)
I get that by choosing the simple model I am saving 15d on the implementation time but incurring a technical debt of 4d for any additional roles.
If I chose the complete model I'd incur an additional 15d of implementation cost, but am I incurring any technical debt?