MAKE PROGRESS YOU CAN VERIFY
Use the agent to move faster, and use evidence to decide what works. Twelve practices to apply from the first brief to the deployed product.
Researched 11 September 2026. These are original Wantlist recommendations informed by the linked official references. They are not a security certification or a guarantee of product success.
Name the user action, expected result and one failure case. Keep the next change small enough to inspect.
Demonstrate the behavior in the running app, then record what remains untested.
Supply relevant files, installed versions and project decisions. Keep standing instructions concise.
Ask it to identify the existing pattern it will extend before a substantial change.
Select one primary database, one identity system and a clear deployment target. Add services when a requirement justifies them.
Draw the request path and identify where validation, identity and permissions are enforced.
Sign-in establishes an identity; every private operation must also enforce access to its target record or file.
Use accounts A and B to test list, direct read, update, delete and download endpoints.
Use production configuration, intended domains and correct callback URLs. Treat email and account recovery as part of the flow.
Try signup, sign-in, sign-out and an expired session with a fresh browser on the deployed URL.
Give browser code only intentionally public configuration. Inspect what build artifacts and logs contain.
Check that privileged API tokens and database credentials are absent from delivered JavaScript and source control.
Keep schema changes versioned. Check their impact on existing rows and rehearse recovery with representative data.
Restore a backup into an isolated environment and run the core application journey against it.
Verify the sender and record event processing so retries do not grant access or trigger effects twice.
Send a valid event twice, an invalid signature and events out of order in a test environment.
Use independent test data and resilient selectors. Focus tests on outcomes a visitor relies on.
Run the critical journey in a fresh browser and confirm saved data survives a reload.
Label fields and explain validation failures. Ensure focus and control behavior make the next action understandable.
Complete the form using a keyboard, including error correction and submission.
Check model output against a small set of representative and difficult examples. Record cost, failure and latency.
Retry a failed request and verify that it does not duplicate a paid or published effect.
Connect failures to the affected release. Measure one meaningful product outcome and keep sensitive data out of telemetry.
Trigger a controlled error, confirm the alert reaches its owner and identify the affected version.
