
State and errors
Define what happens to entered data when a request fails or a session expires. Users should not lose work without clear feedback. Review the whole path instead of judging one screen in isolation.
Check access on the server for each important action. A hidden button is not an access-control boundary. Review consent and privacy requirements before adding tracking.
- A written brief
- Named responsibilities
- Agreed review points




