
State and errors
Define what happens to entered data when a request fails or a session expires. Users should not lose work without clear feedback. Confirm that forms, phone links, and replies reach the right person.
Check access on the server for each important action. A hidden button is not an access-control boundary. Agree a secure handover process for accounts and source files.
- A written brief
- Named responsibilities
- Agreed review points




