Product Discovery Questions for App Platform Projects

A reference product answers what users already understand; it does not answer why they will choose this product, how the business will operate it or which constraint deserves the first engineering dollar.

Discovery should eliminate expensive assumptions before they become architecture. The output is a set of decisions and evidence, not a decorative requirements document.

This guide turns the early conversation into testable product and operating choices.

Define the target customer

Define the target customer is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats define the target customer as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for define the target customer before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For define the target customer, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test define the target customer through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned define the target customer decision and acceptance record
• Stop condition: define the target customer cannot be explained or recovered from durable evidence

Name the painful decision

Name the painful decision is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats name the painful decision as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for name the painful decision before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For name the painful decision, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test name the painful decision through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned name the painful decision decision and acceptance record
• Stop condition: name the painful decision cannot be explained or recovered from durable evidence

Map the current workaround

Map the current workaround is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats map the current workaround as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for map the current workaround before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For map the current workaround, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test map the current workaround through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned map the current workaround decision and acceptance record
• Stop condition: map the current workaround cannot be explained or recovered from durable evidence

Quantify the desired outcome

Quantify the desired outcome is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats quantify the desired outcome as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for quantify the desired outcome before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For quantify the desired outcome, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test quantify the desired outcome through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned quantify the desired outcome decision and acceptance record
• Stop condition: quantify the desired outcome cannot be explained or recovered from durable evidence

Checkpoint 4: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Choose the reference pattern

Choose the reference pattern is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats choose the reference pattern as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for choose the reference pattern before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For choose the reference pattern, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test choose the reference pattern through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned choose the reference pattern decision and acceptance record
• Stop condition: choose the reference pattern cannot be explained or recovered from durable evidence

Separate parity from differentiation

Separate parity from differentiation is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats separate parity from differentiation as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for separate parity from differentiation before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For separate parity from differentiation, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test separate parity from differentiation through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned separate parity from differentiation decision and acceptance record
• Stop condition: separate parity from differentiation cannot be explained or recovered from durable evidence

Map every operating role

Map every operating role is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats map every operating role as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for map every operating role before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For map every operating role, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test map every operating role through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned map every operating role decision and acceptance record
• Stop condition: map every operating role cannot be explained or recovered from durable evidence

Model the core lifecycle

Model the core lifecycle is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats model the core lifecycle as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for model the core lifecycle before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For model the core lifecycle, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test model the core lifecycle through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned model the core lifecycle decision and acceptance record
• Stop condition: model the core lifecycle cannot be explained or recovered from durable evidence

Checkpoint 8: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Identify trust and safety risks

Identify trust and safety risks is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats identify trust and safety risks as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for identify trust and safety risks before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For identify trust and safety risks, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test identify trust and safety risks through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned identify trust and safety risks decision and acceptance record
• Stop condition: identify trust and safety risks cannot be explained or recovered from durable evidence

Define financial obligations

Define financial obligations is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats define financial obligations as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for define financial obligations before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For define financial obligations, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test define financial obligations through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned define financial obligations decision and acceptance record
• Stop condition: define financial obligations cannot be explained or recovered from durable evidence

Audit data and integration needs

Audit data and integration needs is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats audit data and integration needs as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for audit data and integration needs before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For audit data and integration needs, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test audit data and integration needs through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned audit data and integration needs decision and acceptance record
• Stop condition: audit data and integration needs cannot be explained or recovered from durable evidence

Scope operator recovery

Scope operator recovery is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats scope operator recovery as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for scope operator recovery before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For scope operator recovery, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test scope operator recovery through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned scope operator recovery decision and acceptance record
• Stop condition: scope operator recovery cannot be explained or recovered from durable evidence

Checkpoint 12: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Set launch evidence

Set launch evidence is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats set launch evidence as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for set launch evidence before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For set launch evidence, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test set launch evidence through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: versioned set launch evidence decision and acceptance record
• Stop condition: set launch evidence cannot be explained or recovered from durable evidence

Rank assumptions by risk

Rank assumptions by risk is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats rank assumptions by risk as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for rank assumptions by risk before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For rank assumptions by risk, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test rank assumptions by risk through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: engineering owner
• Release evidence: versioned rank assumptions by risk decision and acceptance record
• Stop condition: rank assumptions by risk cannot be explained or recovered from durable evidence

Create the MVP decision record

Create the MVP decision record is a separate decision within a founder-led product team adapting a familiar platform pattern to a distinct market. It changes the customer promise, role authority, durable evidence and recovery path.

The failure mode is concrete: the team treats create the mvp decision record as a feature label while lifecycle, permissions, consequences and ownership remain implicit. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the lifecycle, owner, allowed transitions, visible result and exception route for create the mvp decision record before implementation. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include For create the mvp decision record, retain stable identifiers, explicit states, server authorization, version checks, timestamps, reason codes, correlation IDs, audit history and a bounded recovery action. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with Test create the mvp decision record through success, retry, stale state, concurrency, revoked authority, timeout, partial failure, correction and reconciliation. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: operations owner
• Release evidence: versioned create the mvp decision record decision and acceptance record
• Stop condition: create the mvp decision record cannot be explained or recovered from durable evidence

Implementation references

Use OWASP API Security Top 10 and record the version applied during review.

Validate against OWASP Authorization Cheat Sheet and record the version applied during review.

Review NIST Cybersecurity Framework 2.0 and record the version applied during review.

Compare with W3C WCAG 2.2 and record the version applied during review.

Continue with MVP Development when turning this guide into delivery scope.

Frequently asked questions

What should teams decide first for product discovery for an app platform?

Define the user outcome, operating owner and cost of an incorrect result.

What belongs in the first release?

One complete journey plus the controls required to operate and recover it.

How should permissions be handled?

Authorize every consequential action on the server using current role and scope.

What evidence should be retained?

Stable identifiers, actors, timestamps, versions, reasons and before-and-after state.

What should be tested?

Success, duplicates, stale state, concurrency, dependency failure and operator recovery.

How are external integrations governed?

Use explicit contracts, idempotency, timeouts, observability and fallback.

Which metrics matter?

Customer outcome, harmful failure, recovery time, operational effort and unit cost.

When should scope expand?

Only after launch evidence identifies a real constraint or repeatable opportunity.

Turn the plan into release evidence

A credible release connects its promise to durable state, scoped authority and an owned recovery route. Every responsible team should reach the same conclusion from the same identifiers.

Keep the first scope narrow enough to rehearse. Expand only after data, permissions, financial consequences and remedies survive retries, outages and human mistakes.