# AI builder job brief

Use this worksheet before comparing products or writing a proposal. Replace the examples with the client’s actual requirements.

## 1. Name the primary job

- Project name:
- Primary audience:
- Primary outcome:
- Public website, application, or both:
- One-sentence reason:

## 2. Inventory the required surfaces

| Surface | Who uses it? | What must they do? | Data involved | Website, app, or either? |
| --- | --- | --- | --- | --- |
| Public pages |  |  |  |  |
| Content management |  |  |  |  |
| Forms or intake |  |  |  |  |
| Signed-in area |  |  |  |  |
| Staff operations |  |  |  |  |
| Reporting |  |  |  |  |

## 3. Define state and ownership

For every record the system stores, answer:

| Record | Created by | Read by | Changed by | Deleted by | Retention or export rule |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |

If there are no application records beyond content and ordinary form submissions, a website-first tool may be enough.

## 4. Write authorization as testable sentences

Examples:

- A client user can read only projects assigned to their organization.
- A staff reviewer can approve a submission but cannot change billing settings.
- An anonymous visitor cannot retrieve another visitor’s draft.

Project-specific rules:

1.
2.
3.

For each rule, name the server-side control and a negative test. Hiding a button is not an authorization control.

## 5. Map failure paths

| Event | User-visible fallback | Retry or reconciliation | Alert owner | Recovery evidence |
| --- | --- | --- | --- | --- |
| Form or save fails |  |  |  |  |
| External API times out |  |  |  |  |
| Duplicate event arrives |  |  |  |  |
| Payment is uncertain |  |  |  |  |
| Bad release ships |  |  |  |  |

## 6. Set acceptance tests

### Website acceptance

- [ ] Approved pages, copy, images, metadata, and redirects are present.
- [ ] Navigation, forms, booking, checkout, and key links work.
- [ ] Representative phone and desktop layouts pass review.
- [ ] Content ownership and client editing boundaries are documented.

### Application acceptance

- [ ] Two users with different roles pass allowed and forbidden access tests.
- [ ] Record creation, update, deletion, validation, and error states are tested.
- [ ] Critical logic is enforced server-side.
- [ ] External actions have retry, duplicate, and reconciliation behavior.
- [ ] Logs, alerts, backups, data export, and restore responsibilities are named.

## 7. Verify the shortlisted product

For each candidate, record the current documentation URL and date checked.

| Requirement | Candidate evidence | Limitation | Test before commitment |
| --- | --- | --- | --- |
| Design and responsive control |  |  |  |
| CMS and client editing |  |  |  |
| Authentication |  |  |  |
| Per-record authorization |  |  |  |
| Server-side logic |  |  |  |
| Integrations and secret handling |  |  |  |
| Preview, release, and rollback |  |  |  |
| Data export and exit |  |  |  |
| Current plan and usage costs |  |  |  |

## 8. Decide the architecture

- Website-only because:
- App-only because:
- Website plus app because:
- Canonical public domain:
- App or portal domain:
- Shared brand assets and navigation owner:
- Handoff owner for website:
- Handoff owner for app:
- Ongoing operator:

## 9. Proposal sentence

Write one sentence that names the job and excludes the adjacent job.

> We are building __________________ for __________________ so they can __________________. The scope includes __________________. It does not include __________________, which requires a separate application or phase.

This worksheet is a scoping aid, not a security review or product certification.