
Authorization
Check access on the server for each important action. A hidden button is not an access-control boundary. Review consent and privacy requirements before adding tracking.
Test the supported browser and device range with representative workflows. Include keyboard use and form error handling. Review both successful actions and errors before launch.
- A written brief
- Named responsibilities
- Agreed review points




