OUTPUT 01
Change packet
Scope, owner, affected surface, rollback trigger, and missing-information list before anyone touches production.
What this field manual produces
OUTPUT 02
Proof checklist
A readable set of route, mobile, keyboard, link, form, and evidence checks sized for the actual change.
OUTPUT 03
Incident handoff
Facts, timestamps, impact, preserved evidence, prohibited actions, and the next accountable owner.
The five-move route
Freeze the request into observable facts.
Name the site, environment, owner, visitor outcome, exact component, known baseline, and what must not change. If the request is vague, return questions instead of letting AI fill gaps.
Classify the action before drafting.
Prepare-only work can become a checklist. A proposed content or configuration change needs review and a rollback plan. Secrets, DNS, permissions, money, deletion, production access, or customer impact are blocked until an authorized operator takes over.
Use AI to make a packet, not a change.
Provide only approved, non-sensitive material. Ask for a concise summary, assumptions, tests, rollback questions, and an escalation note. Reject invented URLs, configuration values, test results, or claims of completion.
Test the smallest safe version.
Use the right environment and evidence. Check the affected route, links or form states, keyboard focus, mobile width, and the change-specific security/access impact. Record evidence without copying secrets.
Release, hold, or hand off honestly.
An accountable person records the decision. If a visitor-impacting issue appears, preserve facts and move it into the incident handoff. Do not let a polished AI summary hide uncertainty or encourage an unreviewed fix.
Agent roles that are useful
| Role | Safe contribution | Human boundary |
|---|---|---|
| Packet drafter | Turns approved notes into a scope, assumptions, questions, and rollback prompts. | Never fills unknowns, runs commands, or receives credentials. |
| QA planner | Proposes test cases tied to the stated change and flags omitted user paths. | A person executes/authorizes tests and judges the result. |
| Accessibility companion | Prompts for keyboard path, focus visibility, labels, target-size, and mobile checks. | Does not certify WCAG conformance or replace user testing. |
| Incident scribe | Formats observed facts, times, impact, evidence, and next owner. | Does not diagnose, contain, notify, or close an incident. |
Safe preparation vs. approval-required work
Safe to prepare
- Draft a change summary, checklist, test matrix, or rollback questions.
- Organize approved screenshots, public URLs, and redacted evidence.
- Summarize approved non-sensitive logs or incident notes.
- Flag missing information and route an owner.
Stop and escalate
- Credentials, tokens, passwords, cookies, production access, or browser profiles.
- Deployments, DNS, permissions, cache purges, database changes, deletions, or security remediation.
- Public publishing, customer messages, vendor tickets, legal notices, billing, or purchase decisions.
- Claims of compliance, accessibility conformance, security, uptime, indexing, or rankings.
Failure modes to catch early
“It looks right” replaces evidence.
Use a named baseline and test record. A visual glance is not proof that links, forms, focus order, cache behavior, or production configuration are correct.
AI receives the keys.
Keep secrets and execution in approved systems controlled by authorized people. Ask AI to draft an escalation note when the work crosses that line.
A rollback is only a sentence.
Write the trigger, responsible owner, and known reversal path before approval. If they are unknown, the packet is not release-ready.
Primary sources and next routes
This guide is a conservative synthesis, not a substitute for an organization’s policies or qualified security, accessibility, legal, or technical review.
- O*NET: Web Administrators — occupation and task context.
- NIST AI Risk Management Framework and NIST SSDF — risk-aware AI and secure-change framing.
- W3C WCAG overview — accessibility review context.
- Google sitemap guidance — canonical/discoverability context.
- OWASP ASVS — security verification reference.
Continue with: Software, Web & Data AI Guide Shop, Business Website Builder Guide, AI Search & Answer Visibility, Software Developers, and Software QA.