Instacart-Style Shopper Workflow Checklist: Picking, Substitutions and Delivery

The difficult part of grocery fulfilment begins after the shopper accepts the batch. Inventory is stale, the barcode differs, produce has variable weight, the customer does not answer and checkout totals no longer match the estimate.

A useful shopper app turns these exceptions into bounded decisions without forcing drivers to call support for every aisle-level problem. State and evidence matter more than a polished list.

This checklist follows a batch from offer through settlement and recovery.

Shopper eligibility and availability

Shopper eligibility and availability is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement shopper eligibility and availability as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for shopper eligibility and availability before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for shopper eligibility and availability. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for shopper eligibility and availability. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved shopper eligibility and availability state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover shopper eligibility and availability from durable records

Batch creation and offer

Batch creation and offer is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement batch creation and offer as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for batch creation and offer before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for batch creation and offer. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for batch creation and offer. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved batch creation and offer state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover batch creation and offer from durable records

Acceptance and reservation

Acceptance and reservation is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement acceptance and reservation as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for acceptance and reservation before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for acceptance and reservation. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for acceptance and reservation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved acceptance and reservation state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover acceptance and reservation from durable records

Store arrival and geofence

Store arrival and geofence is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement store arrival and geofence as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for store arrival and geofence before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for store arrival and geofence. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for store arrival and geofence. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved store arrival and geofence state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover store arrival and geofence from durable records

Checkpoint 4: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Pick-list ordering

Pick-list ordering is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement pick-list ordering as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for pick-list ordering before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for pick-list ordering. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for pick-list ordering. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved pick-list ordering state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover pick-list ordering from durable records

Barcode and item verification

Barcode and item verification is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement barcode and item verification as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for barcode and item verification before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for barcode and item verification. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for barcode and item verification. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved barcode and item verification state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover barcode and item verification from durable records

Weighted item capture

Weighted item capture is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement weighted item capture as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for weighted item capture before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for weighted item capture. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for weighted item capture. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved weighted item capture state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover weighted item capture from durable records

Unavailable item handling

Unavailable item handling is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement unavailable item handling as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for unavailable item handling before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for unavailable item handling. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for unavailable item handling. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved unavailable item handling state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover unavailable item handling from durable records

Checkpoint 8: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Customer substitution approval

Customer substitution approval is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement customer substitution approval as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for customer substitution approval before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for customer substitution approval. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for customer substitution approval. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved customer substitution approval state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover customer substitution approval from durable records

Checkout and receipt evidence

Checkout and receipt evidence is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement checkout and receipt evidence as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for checkout and receipt evidence before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for checkout and receipt evidence. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for checkout and receipt evidence. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved checkout and receipt evidence state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover checkout and receipt evidence from durable records

Bag and temperature controls

Bag and temperature controls is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement bag and temperature controls as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for bag and temperature controls before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for bag and temperature controls. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for bag and temperature controls. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved bag and temperature controls state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover bag and temperature controls from durable records

Handoff to delivery

Handoff to delivery is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement handoff to delivery as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for handoff to delivery before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for handoff to delivery. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for handoff to delivery. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved handoff to delivery state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover handoff to delivery from durable records

Checkpoint 12: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Proof of delivery

Proof of delivery is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement proof of delivery as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for proof of delivery before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for proof of delivery. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for proof of delivery. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved proof of delivery state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover proof of delivery from durable records

Shopper earnings and adjustments

Shopper earnings and adjustments is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement shopper earnings and adjustments as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for shopper earnings and adjustments before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for shopper earnings and adjustments. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for shopper earnings and adjustments. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved shopper earnings and adjustments state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover shopper earnings and adjustments from durable records

Offline sync and support recovery

Offline sync and support recovery is a distinct part of a grocery fulfilment platform coordinating stores, shoppers, customers and couriers. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement offline sync and support recovery as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for offline sync and support recovery before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for offline sync and support recovery. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for offline sync and support recovery. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved offline sync and support recovery state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover offline sync and support recovery from durable records

Implementation references

Use Instacart Connect Fulfillment API and record the version used for release.

Validate against GS1 standards and record the version used for release.

Review OWASP API Security Top 10 and record the version used for release.

Compare with W3C WCAG 2.2 and record the version used for release.

Continue with Instacart Clone when turning this guide into scope.

Frequently asked questions

What is the first shopper workflow to perfect?

Accept, pick, resolve substitutions, check out and deliver one basket with evidence.

How should stale inventory be handled?

Through explicit unavailable and substitution states, not silent replacement.

What about weighted goods?

Capture actual measured quantity, pricing evidence and customer-visible total changes.

Can shoppers buy without receipt capture?

The proof requirement should follow the payment and reconciliation model.

How should batches be assigned?

With eligibility, capacity, offer expiry and idempotent acceptance.

What happens offline?

Queue stable commands, preserve occurrence time and resolve conflicts after reconnection.

How are shopper earnings calculated?

From versioned base, distance, effort, incentive and adjustment inputs.

What should be tested?

Final-batch concurrency, unavailable items, silence, weight changes, checkout failure and offline delivery.

Turn the plan into release evidence

A credible release connects its promise to durable state, scoped authority and recoverable operations. The team should explain ordinary journeys and important exceptions from the same records.

Keep the first scope narrow enough to rehearse. Expand only after access, money, evidence and support outcomes remain consistent under retries, failures and human mistakes.