Modal Verbs: Obligation and Permission in Technical English
0 / 10 completed
1 / 10
An API security policy states: "All API clients _____ authenticate using a valid Bearer token on every request."
Which modal expresses a strict, non-negotiable requirement?
Which modal expresses a strict, non-negotiable requirement?
Must is correct. In technical specifications following RFC 2119, MUST indicates an absolute requirement. Non-compliance means the implementation is non-conformant. "May" grants optional permission. "Should" is a recommendation (SHOULD in RFC 2119 means there may be valid reasons to ignore it). "Need" is not a standard RFC modal — in specs, use "must" or "need to" for requirements.
2 / 10
A REST API reference says: "Clients _____ pass an
Which modal best signals an optional but strongly recommended behaviour?
Idempotency-Key header to prevent duplicate requests, but it is strongly recommended for write operations."Which modal best signals an optional but strongly recommended behaviour?
Should is correct. RFC 2119 defines SHOULD as: "there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course." The phrase "strongly recommended" confirms this — the client is not obligated, but deviation requires justification. "Must" is absolute. "May" is merely optional. "Shall" has the same force as "must" but is more formal/legalistic.
3 / 10
A compliance document states: "Developers _____ not store plaintext passwords in any database, log file, or environment variable."
Which modal signals an absolute prohibition?
Which modal signals an absolute prohibition?
Must is correct. "Must not" (MUST NOT in RFC 2119) is an absolute prohibition — no exceptions. "Should not" is a strong recommendation against, but allows for justified exceptions. "May not" has ambiguity in everyday English (it can mean "is not allowed to" or "might not") — in technical specs, avoid using "may not" for prohibition; use "must not" instead. "Need not" means "is not required to" — which is the opposite of a prohibition.
4 / 10
A runbook instruction reads: "Engineers on call _____ acknowledge an alert within 5 minutes of receipt during business hours."
Which modal expresses an organisational obligation?
Which modal expresses an organisational obligation?
Are required to is correct in this compliance context. The runbook establishes a binding SLA-level obligation — not merely a recommendation. "Are required to" conveys the same absolute obligation as "must" but in a more formal administrative register. "Should" is a recommendation. "May" is permission. "Might" is speculative possibility, entirely inappropriate here.
5 / 10
An API reference states: "The
Which modal grants optional permission without implying a recommendation?
fields query parameter _____ be used to request a partial response containing only specified fields."Which modal grants optional permission without implying a recommendation?
May is correct. RFC 2119 defines MAY as optional — the user may choose to use this feature or not. It is neither recommended nor discouraged. "Must" implies obligation. "Should" implies a recommendation that most users should follow. "Shall" is equivalent to "must" — it indicates a requirement, not an option.
6 / 10
A security policy states: "Service accounts _____ have more permissions than are strictly necessary for their function."
Which modal creates a prohibition aligning with the principle of least privilege?
Which modal creates a prohibition aligning with the principle of least privilege?
Must not is correct. The principle of least privilege is a security requirement, not merely a guideline — service accounts are prohibited from having excess permissions. "Must not" (= MUST NOT in RFC 2119) is the strongest prohibition. "Should not" indicates it is inadvisable but allows exceptions. "May not" is ambiguous (prohibition or possibility?). "Need not" means "is not required to" — the opposite meaning.
7 / 10
A technical spec reads: "The client _____ retry the request using exponential backoff if the server returns a 503 response."
Which modal best expresses a strong recommendation that allows exceptions?
Which modal best expresses a strong recommendation that allows exceptions?
Should is correct. Retry logic is a best practice recommendation — most clients should implement it, but an internal tool making one-off requests may legitimately omit it. "Should" (RFC 2119 SHOULD) signals this recommendation-with-flexibility. "Must" would make retry mandatory for all compliant clients. "May" would suggest it is merely permitted, not encouraged. "Will" is a future statement, not a requirement.
8 / 10
Which sentence uses an obligation/permission modal INCORRECTLY in a technical context?
Option C is ambiguous and therefore incorrect for a formal spec. "May not" has two possible readings: (1) permission denial — "is not permitted to", or (2) possibility — "might not be." In a technical or legal specification, this ambiguity is unacceptable. Use "must not" for prohibition. The intended meaning is almost certainly prohibition, so the correct phrasing is: "The API must not be used for real-time financial trading without a dedicated licence." Options A, B, and D all use modals correctly.
9 / 10
A developer portal note says: "You _____ upgrade to API v3 immediately — v2 will be deprecated next quarter."
Which modal most accurately expresses urgent advice without making it a strict requirement?
Which modal most accurately expresses urgent advice without making it a strict requirement?
Should is correct. "You should upgrade immediately" conveys strong advice — the speaker believes it is the right course of action and that the reader will likely face negative consequences for ignoring it, but it is not technically mandatory. "Must" would imply that continued use of v2 is prohibited now, which contradicts "next quarter." "May" implies it is only an option with no recommendation. "Can" expresses capability, not advice.
10 / 10
An infrastructure policy document states: "Production deployments _____ only be triggered by the CI/CD pipeline — direct SSH access to production servers _____ not be used for deployments."
Which pair of modals is correct?
Which pair of modals is correct?
Must / must is correct. Both clauses are absolute requirements — one affirmative obligation (deployments must go through CI/CD) and one absolute prohibition (manual SSH deployments are forbidden). This is a security policy, not a recommendation. "Should / can" makes both rules advisory. "May / need" introduces optional permission where mandatory control is intended. "Can / should" creates a capability statement and advisory, not enforceable policy.