Plan public, authenticated, and organization-scoped routes, including direct links, refresh, revoked access, and missing resources.

How to apply it

Use semantic labels, keyboard navigation, visible focus, accessible dialogs, loading/error states, and server-side validation. Personalized server-rendered output must not enter shared caches without correct user and tenant cache keys.

Worked example

A workspace form shows field errors, disables duplicate submissions while saving, and preserves recoverable input after a failure.

Common mistakes to avoid

Using color alone for errors or treating hidden buttons as security controls.

Practice task

Implement this concept in the capstone. Add one positive test, one negative or failure-path test, and a short note explaining the trade-off you chose.