TBD is intended to be a solution to the problem of up-front design, not its cause. Here’s a brief excerpt from an interview with Andy Hunt and Dave Thomas illustrates the point [http://www.artima.com/intv/tracer.html]:

“The software analog to firing heavy artillery by calculating everything up front is saying, “I’m going to specify everything up front, feed that to the coders, and hope what comes out the other end is close to my target.” Instead, the tracer bullet analogy says, “Let’s try and produce something really early on that we can actually give to the user to see how close we will be to the target.”"

Ship It! illustrates an application of this process a bit by suggesting that for the first iteration, maybe your entire authentication system will be a single login function that returns True no matter what. This is certainly something that will need to change and evolve, but may be enough to have a running conceptual overview of the system, which is valuable for getting early feedback.