
State and errors
Define what happens to entered data when a request fails or a session expires. Users should not lose work without clear feedback. Check the destination as well as the message that sends people there.
Check access on the server for each important action. A hidden button is not an access-control boundary. Use only the customer information needed for the agreed work.
- A written brief
- Named responsibilities
- Agreed review points




