
State and errors
Define what happens to entered data when a request fails or a session expires. Users should not lose work without clear feedback. Try the main customer task on a phone before signing off.
Check access on the server for each important action. A hidden button is not an access-control boundary. Keep a record of permission for any customer story used publicly.
- A written brief
- Named responsibilities
- Agreed review points




