
System boundaries
Define which service owns records and how the app reads or updates them. Handle expired sessions and unavailable systems explicitly. Keep the scope specific enough to check at each review.
Test staff and customer roles using realistic records. Sensitive information should not appear merely because a screen is hidden in navigation. Record the tools, owners, and renewal dates involved.
- A written brief
- Named responsibilities
- Agreed review points




