Healthcare App Development Questions to Answer Before an MVP

The most important healthcare MVP question is not which framework to use. It is what decision the product influences, which health information it holds, who may rely on it and what happens when its data is incomplete or wrong.

A booking tool, care-navigation product and clinical decision function can look similar in a prototype while carrying very different operating and regulatory consequences. Those boundaries must be explicit before development.

This guide turns the pre-MVP discussion into decisions the team can test and preserve.

Define the intended use

Define the intended use is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement define the intended use as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for define the intended use before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for define the intended use. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for define the intended use. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved define the intended use state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover define the intended use from durable records

Identify every user and organization

Identify every user and organization is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement identify every user and organization as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for identify every user and organization before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for identify every user and organization. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for identify every user and organization. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved identify every user and organization state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover identify every user and organization from durable records

Map sensitive data and purpose

Map sensitive data and purpose is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement map sensitive data and purpose as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for map sensitive data and purpose before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for map sensitive data and purpose. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for map sensitive data and purpose. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved map sensitive data and purpose state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover map sensitive data and purpose from durable records

Choose the system of record

Choose the system of record is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement choose the system of record as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for choose the system of record before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for choose the system of record. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for choose the system of record. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved choose the system of record state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover choose the system of record from durable records

Checkpoint 4: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Design patient identity matching

Design patient identity matching is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement design patient identity matching as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for design patient identity matching before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for design patient identity matching. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for design patient identity matching. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved design patient identity matching state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover design patient identity matching from durable records

Set consent and authorization rules

Set consent and authorization rules is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement set consent and authorization rules as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for set consent and authorization rules before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for set consent and authorization rules. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for set consent and authorization rules. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved set consent and authorization rules state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover set consent and authorization rules from durable records

Model appointments and availability

Model appointments and availability is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement model appointments and availability as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for model appointments and availability before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for model appointments and availability. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for model appointments and availability. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved model appointments and availability state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover model appointments and availability from durable records

Plan clinical and administrative messaging

Plan clinical and administrative messaging is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement plan clinical and administrative messaging as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for plan clinical and administrative messaging before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for plan clinical and administrative messaging. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for plan clinical and administrative messaging. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved plan clinical and administrative messaging state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover plan clinical and administrative messaging from durable records

Checkpoint 8: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Define document intake and review

Define document intake and review is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement define document intake and review as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for define document intake and review before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for define document intake and review. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for define document intake and review. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved define document intake and review state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover define document intake and review from durable records

Choose interoperability boundaries

Choose interoperability boundaries is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement choose interoperability boundaries as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for choose interoperability boundaries before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for choose interoperability boundaries. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for choose interoperability boundaries. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved choose interoperability boundaries state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover choose interoperability boundaries from durable records

Set emergency and escalation behavior

Set emergency and escalation behavior is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement set emergency and escalation behavior as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for set emergency and escalation behavior before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for set emergency and escalation behavior. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for set emergency and escalation behavior. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved set emergency and escalation behavior state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover set emergency and escalation behavior from durable records

Design staff permissions

Design staff permissions is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement design staff permissions as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for design staff permissions before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for design staff permissions. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for design staff permissions. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved design staff permissions state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover design staff permissions from durable records

Checkpoint 12: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Plan audit and retention

Plan audit and retention is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement plan audit and retention as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for plan audit and retention before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for plan audit and retention. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for plan audit and retention. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved plan audit and retention state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover plan audit and retention from durable records

Establish accessibility requirements

Establish accessibility requirements is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement establish accessibility requirements as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for establish accessibility requirements before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for establish accessibility requirements. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for establish accessibility requirements. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved establish accessibility requirements state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover establish accessibility requirements from durable records

Rehearse incidents and recovery

Rehearse incidents and recovery is a distinct part of a healthcare product handling sensitive records, appointments and care-adjacent workflows. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement rehearse incidents and recovery as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for rehearse incidents and recovery before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for rehearse incidents and recovery. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for rehearse incidents and recovery. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved rehearse incidents and recovery state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover rehearse incidents and recovery from durable records

Implementation references

Use HHS HIPAA Security Rule guidance and record the version used for release.

Validate against HL7 FHIR R4 and record the version used for release.

Review FDA Software as a Medical Device and record the version used for release.

Compare with NIST Cybersecurity Framework 2.0 and record the version used for release.

Continue with Healthcare Industry when turning this guide into scope.

Frequently asked questions

What should healthcare founders decide first?

The intended use, user, decision impact and prohibited reliance.

Does every healthcare app need the same compliance design?

No. Data, geography, parties and intended use determine obligations.

Should an MVP integrate every clinical system?

No. Start with the minimum authoritative interfaces needed for the chosen workflow.

How should patient identity be handled?

With durable identifiers, matching evidence and reversible merge or split operations.

What makes consent usable?

Clear scope, version, effective time, withdrawal behavior and enforcement.

What should be logged?

Security-relevant access, changes, decisions and failures without exposing unnecessary sensitive content.

How should emergencies be handled?

Publish clear limitations and route urgent situations to an appropriate human channel.

What must be tested?

Authorization, data mismatch, scheduling concurrency, integration outage, accessibility and incident recovery.

Turn the plan into release evidence

A credible release connects its promise to durable state, scoped authority and recoverable operations. The team should explain ordinary journeys and important exceptions from the same records.

Keep the first scope narrow enough to rehearse. Expand only after access, money, evidence and support outcomes remain consistent under retries, failures and human mistakes.