01
Padrão Digital de Governo (DSGov)
The Brazilian federal government's official design standard, published by the Secretariat of Digital Government. It is the reference source for the entire federal government.
Lighthouse on the home page: 92 out of 100. Documentation audit: 202 level AA failures.
An open audit protocol with governance recommendations for government design systems. I audited the DSGov and Bold documentation with the same procedure and found 277 level AA barriers: 202 in DSGov and 75 in Bold. In an isolated fork of the Menu Push example, the correction indicated by the method reduced two structural-rule flags from 22 to zero under the same audit. As of August 3, 2026, the maintainer had not incorporated the fork.
Accessibility by Default
- Undergraduate thesis defended at UFSC, grade 10 out of 10, December 2025
- Open data
- Replicable method
Declared conformance is not verified conformance.
Public digital services are essential civic infrastructure, not a convenience. Brazilian law guarantees the right of access, and millions of people depend on it.
Both systems declare conformance with WCAG and eMAG. The documentation audit found failures in the portal shell and copyable examples; it did not transfer those findings to distributed code.
18.6 million
people with disabilities in Brazil in 2022, 8.9% of the population.
IBGE, PNAD Contínua 2022
The barrier is not only in the published screen. It can live in the source that produces the screen.
Three objects, three limits of inference.
Design systems organize reusable components and examples for building services. When a team reuses an example or component, a barrier in that object may travel with it.
This study distinguishes the documentation portal shell, copyable examples and distributed code. It did not measure propagation in a derived service.
Diagram of three audited objects without presumed inheritance
- Portal shell
- Copyable examples
- Distributed code
If a maintainer team adopts a corrected version, the correction may reach services that use that version.
What was audited, and why these two.
02
Bold Design System
The design system of Laboratório Bridge, at UFSC. An academic comparison case audited with the same procedure.
Fairness note
The procedure was identical for both: same flow, same test suite, same 8 verification categories and same environment. The study also credits what the systems get right: both passed 100% of the visible-focus checks, with no focus trap, across the instrumented components.
Disclosure
The author has an academic affiliation with UFSC. Independent tools, an identical procedure and Bold's higher internal share of critical failures compared with DSGov (40.0% versus 22.3%) are documented mitigations for potential bias.
A protocol in four layers.
The method is the Hybrid Audit and Verification Framework. It integrates four complementary layers, converts abstract standards into auditable metrics, and keeps every finding tied to archived evidence.
The four layers
- 01
Automated audit
axe-core, Lighthouse and WAVE over the official component documentation.
- 02
Heuristic inspection
Guided by the WAI-ARIA practices.
- 03
eMAG 3.1 checklist
The Brazilian standard, item by item.
- 04
Synthesis matrix
Consolidation and prioritization of the barriers found.
Counting pipeline
The count goes through an auditable funnel:
- 1
Raw
The complete tool results.
- 2
Deduplication
By rule plus selector plus context.
- 3
AA filter
Only what violates level AA remains.
Every finding has a 26-field evaluation record, tied to the standard (WCAG, eMAG, WAI-ARIA) and to the evidence.
Reproducible environment
Pinned environment with tool version, browser and viewport recorded. Public scripts under MIT, data under CC BY 4.0 and SHA-256 hashes support rerunning the audit. As of August 3, 2026, its usability with a real team had not been tested.
- MIT (scripts)
- CC BY 4.0 (data)
- SHA-256 (integrity)
Per-Component Verification Checklist
Appendix C of the thesis on one page: the priority checks per component, with WCAG and eMAG criteria and the recommended actions for each system.
Download the checklist (PDF, 1 page, in Portuguese)Source: Xikota, T. K. C. Acessibilidade Digital em Design Systems Públicos, undergraduate thesis, UFSC, 2025, Appendix C.
What the audit found.
277
unique level AA non-conformities in the official documentation of the two systems.
- Bold27% of the total
- 75
- DSGov73% of the total
- 202
Unit of analysis: unique non-conformity = rule + selector + context, after deduplication; occurrence = a node flagged by the rule.
Table 4 of the thesis
The illusion of the high score
Meanwhile, the automated accessibility score of the home pages was 98 for Bold and 92 for DSGov. The high score coexists with 75 and 202 verified failures in the documentation.
Lighthouse score (home page)
0 / 100
Bold
98
DSGov
92
Verified AA failures (documentation)
0 / 220
Bold
75
DSGov
202
Tables 4 and 7 of the thesis
A high score is not enough.
The institutional paradox
The government's official reference fails its own standard, on its own site.
Object 01
Documentation portal shell
This is where the audit recorded aria-required-parent (40 occurrences) and listitem (37 occurrences) in DSGov, with zero incidence in Bold. These are documentation portal failures, with no evidence that consuming services inherit them.
Object 02
Copyable code examples
This is where contrast failures in the reference documentation are concentrated. The isolated Menu Push pilot belongs to this object and has its own scope.
Object 03
Distributed component code
This is distinct from the shell and the examples. The audit does not transfer the structural portal failures to the distributed code.
Table 5 of the thesis
The most frequent barrier
Contrast below 4.5:1 is the most frequent barrier: 128 occurrences across the two systems combined, concentrated in the code example blocks of the reference documentation. In DSGov, contrast accounts for about 53% of the failures.
The measured contrast ratios include 4.02:1 and 3.75:1 in Bold and 3.07:1 and 3.58:1 in DSGov, all below the 4.5:1 minimum.
Section 4.4.5 and Chart 2 of the thesis
Re-audit
I re-ran the protocol against the live version of both systems on July 30, 2026, with a pinned environment, and recorded the diffs against the September to November 2025 collection in the open dataset. None of the study's anchor numbers changed.
From abstract standard to design decision.
The POUR synthesis reorganizes the findings by the human capability affected, without reopening the method.
Perceivable
41 of 137 checks
Operable
19 of 45 checks
Understandable
15 of 20 checks
Robust
0 of 0 checks
The zero under Robust is a classification artifact, not an absence of errors: the ARIA structure errors were coded under another guideline (1.3.1).
This view sets priorities by their effect on people, not by the order in which a tool reports findings.
Four proposed governance mechanisms.
- 01
Accessibility gate in CI/CD
If adopted, it can block regressions detected by the test suite before a release.
- 02
Per-component accessibility contract
Proposal to include accessibility requirements in the Definition of Done.
- 03
Single source of truth
Proposal to maintain one canonical place for the component and its accessible behavior.
- 04
Public conformance dashboard
Proposal to publish the series of non-conformities under a constant scope.
Feasibility note
The mechanisms reuse the pipeline run in this study. The audit layer produced the 277 barriers. As of August 3, 2026, no agency had deployed the four governance mechanisms.
Adoption of the protocol by an agency can keep new barriers from entering via the CI/CD gate. It is a recommendation, not a deployment.
Proof of concept for the correction
Experimental correction in a fork, not incorporated by the maintainer as of August 3, 2026
Before
22 nodes
21 aria-required-parent + 1 aria-required-children
Intervention
Semantic correction in the isolated Menu Push example fork
After
0 nodes
Under the same pinned fork audit
The correction specified by the protocol was applied to a fork of the sample code of the DSGov menu component (Push variant, developer tab). Under the same pinned audit, the 22 ARIA structure violation nodes (aria-required-parent 21, aria-required-children 1) stopped being flagged. Before, after, diff and hashes are published in the open dataset.
The 21 aria-required-parent nodes in the fork cover one example page, a subset of the 40 occurrences recorded in the shell across DSGov pages. The listitem rule did not reproduce in the isolated fork and remains recorded in the portal shell.
On July 31, 2026, I reported the defect and the experimental correction to the maintainer, in a public issue on the official DSGov repository. As of August 3, 2026, the issue had no response. See the public issue (261)(external link)
What can be verified now, and what still depends on adoption.
Delivered and verifiable today
- The evidence is published and can be downloaded now.
- 277 traced barriers, each with a record and archived evidence.
- Open dataset, checklist and evaluation records published for reuse.
- Open protocol for replication: the steps, scripts and data support rerunning the audit on another design system. As of August 3, 2026, its usability with a real team had not been tested.
Potential
- Any system-wide effect remains potential and depends on adoption by a maintainer team.
- Adopting the gate can keep new barriers from entering.
- Less duplicated rework, longer-lived components and less duplicate auditing can reduce digital and operational waste.
How success is measured
By the number of unique level AA non-conformities under constant scope (same pages, same test suite, pinned environment), broken down by severity. Today: 202 in DSGov and 75 in Bold. Success means that series falls (critical and serious first) without regressing, published on the conformance dashboard. Constant scope keeps the yardstick from being gamed by changing the sample.
Environmental note
As of August 3, 2026, the project had not measured environmental impact. Reusing open evidence, avoiding duplicate audits and reducing rework are efficiency hypotheses, not demonstrated environmental results.
What this study did not do, stated in full.
- 01
There was no testing with people. The analysis covers documents and code, with automated auditing and heuristic inspection by one auditor. No user testing, no participation of people with disabilities, no screen reader operated by the author, no second evaluator.
- 02
Automated coverage reaches about one sixth of the WCAG criteria (Fischer, Lundell and Gamalielsson, 2025). The rest depends on manual inspection, which does not scale with a single auditor.
- 03
It is a snapshot from September to November 2025. Systems change; the number is dated.
- 04
The propagation of a barrier through consuming services is a structural mechanism of adoption, treated in conditional language. No effect was measured in any derived service.
- 05
The author's affiliation with UFSC is declared. Mitigations: independent tooling, identical procedure, and Bold's internal share of critical failures being higher than DSGov's (40.0% versus 22.3%).
Every limitation is also the next step. Nothing here is hidden, because nothing here needs to be.
Where the evidence can grow.
- 01
Run sessions with people with disabilities and screen readers to validate in use the barriers identified by the code audit.
- 02
Expand manual inspection and add a second evaluator to increase coverage beyond automated checks.
- 03
Bring the protocol to a maintainer team to test the non-regression gate in real operation.
- 04
Repeat the audit on new snapshots to turn the current snapshot into a time series.
These are planned steps. This page does not claim any of them has already happened.
Source, data and credits.
Primary source
- Full monograph (PDF, 86 pages, in Portuguese)
- Deposit record, UFSC Institutional Repository(external link)
- Archived version with DOI, Zenodo(external link)
- Open dataset, scripts and reports (GitHub)(external link)
Data under CC BY 4.0, scripts under MIT.
Academic credit
- Author
- Thiago Kenji Corrêa Xikota
- Advisor
- Prof. Raul Sidnei Wazlawick
- Committee
- Raul Sidnei Wazlawick, Berenice Santos Gonçalves, Fabiane Barreto Vavassori Benitti
- Institution
- Universidade Federal de Santa Catarina, BSc in Computer Science
- Defense
- December 10, 2025, grade 10 out of 10
A work derived from the same research was approved on the official list of the BrasilGov Academy Forum 2026 under the title Inclusão por Padrão (academic circuit). Accessibility by Default is the name of the protocol in the design circuit. Same research, two circuits, both declared.
Accessibility of this page.
This page aims for WCAG 2.2 level AA conformance. A page that argues for accessibility has the obligation to be accessible.
- Conformance status
- Meets the WCAG 2.2 level AA criteria covered by this self-assessment
- Assessment date
- August 4, 2026
- Method
- Self-assessment using axe, Lighthouse and a manual checklist by one evaluator. Includes criterion 2.4.11, Focus Not Obscured (Minimum), and criterion 2.5.8, Target Size (Minimum). No user testing and no external evaluator.
- Result and evidence
axe: zero violations. Lighthouse accessibility: 100. The score remains attached to the full report so you can verify what it does not show.
Full audit of this page
Found a barrier here? Write to thiagoxikota@gmail.com. The report will be used to review this self-assessment.
The evidence is open to scrutiny
Everything supporting this case is public: the deposited thesis, the DOI record and the dataset with SHA-256 hashes. Inspect the method, reproduce the count and challenge anything the evidence does not support.
If you want to discuss the evidence or the protocol, the contact channel remains open.
Discuss the protocol