Also find out if he is a backpack person or a bag on the bike person.
If backpack, you are all set.
If bike bag, get a bag and rack system that will allow instant removal, as easy as taking off a helmet. I like the Topeak MTX system of click-rack and bag, but there are others.
There is no such thing as a permanently attached bag. Though the MTX can be locked fairly easily (lock or cable through the back of the rack, preventing bag from being able to slide out as normal), the only sure-fire method is removal *every time*. Plus, that won't protect the contents.
The rack and bag could easily cost as much as a bike. But don't try to skimp out here with non-matching or non-click rack and bag. If you do, you could easily lose it and everything inside.