The Limits of Gherkin for Security Requirements: A Complexity Threshold in Behaviour-Driven Development

This preprint investigates the expressive boundaries of Behaviour-Driven Development (BDD) in security-critical software engineering. It argues that while Gherkin-based BDD enhances clarity and early validation of functional requirements, it cannot adequately represent non-functional or architectural security constraints such as encryption, key management or compliance auditing. Synthesising evidence from academic and industrial research—including large-scale case studies by Irshad et al. (2021) and architectural findings by Olmsted (2024)—the paper defines a complexity threshold beyond which declarative scenario languages fail. It concludes with a hybrid framework that combines BDD, UML security stereotypes, formal verification, and AI-assisted requirement analysis, providing a practical roadmap for achieving genuine security-by-design assurance in modern software systems.