A short document (2–3 pages, Google Doc or PDF) with:

Your choice and why — link it to security, testability and one more quality attribute you care about.
Two alternatives you rejected, and the trade-off that ruled each one out.
An architecture diagram (Excalidraw, like the hands-on): components with labelled arrows, e.g. Browser → API → Auth → Pass Service → Database, and dashed trust boundaries.
Two security scenarios (source → stimulus → response → measure) and the tactics that handle them: authenticate, authorize, validate input, limit exposure, audit.
One testability scenario, and what in your design makes it testable (fake data source, test doubles, logging).
Two ADRs — for each: context, decision, consequences.