
State and errors
Define what happens to entered data when a request fails or a session expires. Users should not lose work without clear feedback. Verify the next step while there is still time to correct a problem.
Check access on the server for each important action. A hidden button is not an access-control boundary. Agree how sensitive material will be shared and stored.
- A written brief
- Named responsibilities
- Agreed review points




