Use whenever you record a claim — attach its verbatim source (the quote, who, when, what kind) so a finding can always be traced back.
Use when there's a technical or scientific claim under the pitch — push on the mechanism in proportion to how load-bearing it is.
Use when handing an initiative or a chunk of work to the engineer — produce a brief with C4-level structure, the exact contract, acceptance, file/seam pointers, illustrative code,…
Use to validate that a design actually works for real people — when a flow is built or prototyped and you need to know if users can do the job.
Use when a security incident is suspected or active (breach, leaked secret, active exploit, suspicious activity) — run the NIST lifecycle: contain, eradicate the root cause,…
Use before any change touches prod — enumerate what's stateful, what's a one-way door, what's reversible, and who's downstream, so rigor matches risk and the irreversible parts…
Use when someone demands "100% uptime," when arbitrating ship-speed vs stability, or when defining how reliable a service must be — set an SLI/SLO and an error budget so…
Use when designing the ergonomics of a terminal / CLI / builder tool — command and flag design, sensible defaults, inferring arguments instead of demanding flags,…
Use when scoping or describing a feature — reframe it as the job the user is hiring it for (the outcome in their words), not the feature itself.
Use when AI coding agents will read/write this codebase, or an AI/LLM feature is proposed — design for the AI reader, defend against AI-accelerated drift, and treat…
Use when investigating a build or a suspicious area where a fixed script won't find the unknown — run time-boxed exploratory sessions guided by a charter (a mission), learning,…
Use for any change before calling it done — prove it with the right tests (unit base + an integration test that hits the real surface and asserts persisted state), then do an…
Use when assessing defensibility and timing — why won't the incumbent (or a well-funded lab) just do this, and what's the durable moat once the easy parts commoditize.
Use before drawing any screen — when asked to "design a page/feature/screen," map the user's task end to end (entry, happy path, branches, every empty/loading/error/edge state,…
Use whenever a change is heading to production or you're asked "is this ready to ship / is it live / is it healthy" — adopt the you-build-it-you-run-it posture and verify by…
Use when more than one entry surface exists or is proposed (CLI, API, MCP, UI, webhook, cron) — make every surface route to one shared core code path, and run a DRY pass for the…
Use whenever a rewrite, redesign, or refactor would remove, replace, or overwrite copy or visuals that are already in place — a tuned headline, a converting landing page, a hero,…
Use when proposing the approach for an initiative, or when tempted to add structure "for future scale" — design the idiomatic, simplest thing that solves the real problem and…
Use when summarizing whether the bet clears the bar — explicitly tally how many unique insights it carries across tech, market, and GTM. One isn't enough; name which ones and why.
Use when writing code that touches I/O, state, concurrency, or external systems — design for failure: validate inputs, fail fast, be idempotent and concurrency-safe, and make it…
Use on every surface — accessibility is designed in, not bolted on. ~80% of accessibility is design decisions (contrast, hierarchy, target size, focus order, labels) made before…
Use when deciding what to say where — a cold ad vs. a homepage vs. a pricing page vs. a re-engagement email — or when copy is pitching the offer to people who don't yet know they…
Use before you test anything — build your own model of "correct" from the brief, spec, and user journeys so you have a basis to call something a bug, and state which expectation…
Use when evaluating the core insight or differentiation — test whether the "secret" is earned or faked.
Use when price, discount, or terms come up at the deal's end — hold value, trade don't give (every concession buys something back), use tactical empathy and calibrated questions.
Use whenever you write or review external copy in someone's voice (the founder/brand), and as a gate on every claim.
Use FIRST, before hunting any bug — write down the system's trust model (who can reach what, which callers are already trusted, what the deployment model is).
Use before calling your own change done, and when reviewing someone else's PR — review against scope, conventions, and what could break; be useful and specific, not a nitpick gate.
Use when ops work is manual, repetitive, and scaling with growth (manual deploys, hand-run migrations, copy-paste fixes, ticket-driven provisioning) — identify the toil and…
Use when entering a codebase, before any design or estimate, or when your mental model has gone stale — read width AND depth and refresh the C4-level picture; a design from a skim…
Use for build-vs-buy, adopting a new framework/database/language, or "should we use X" — apply the innovation-token test; default to the well-understood; a stack only the AI…
Use whenever a surface will be seen on more than one screen size or input — which is almost always (62%+ of web traffic is mobile).
Use when reviewing an LLM feature, AI agent, RAG system, or tool/MCP integration — treat the OWASP LLM Top 10 as its own attack class: prompt injection, excessive agency, tool…
Use when a call is hard-to-change or a one-way door (persistence, boundaries, public interfaces, the build/deploy path, a dependency) — record an ADR; immutable once accepted,…
Use when protecting working behavior across changes — keep a fast, risk-prioritized regression gate on the highest-value journeys, and quarantine-and-own a flaky test instead of…
Use before building on or committing to a vendor/runtime (cloud, PaaS, serverless, queue, DB, third-party API) — read the actual pricing, runtime-limits, and execution-model docs…
Use when assessing the founder's ceiling — can they paint the huge future AND walk the exact next step, and do they bend reality or wait for permission.
Use when reviewing a proposed architecture, a tech plan, or a PR for soundness — drive it to correctness/simplicity/fit, enable rather than gatekeep, flag the open gate without…
Use the moment prod is broken/degraded or an alert fires — declare an incident, take command, mitigate before diagnosing, and communicate on a cadence.
Use when documenting how to deploy, operate, or recover a service, or after learning something a release/incident taught you — write a runbook so good a competent stranger could…
Use while writing any diff — make it look like the rest of the codebase wrote it: match conventions, reuse shared components, stay DRY, write for the next human, and never leave a…
Use on every surface before it ships — the pre-merge craft pass. Work the polish checklist (tabular nums, optical alignment, concentric radius, shadow-vs-border, focus, type…
Use when a new dependency is added, a CVE is reported, or the build/CI pipeline is reviewed — assess reachability not just presence, pin and lock deps, and treat the…
Use to land your review as a durable artifact — the attack surface reviewed, findings at file:line (or "none"), the P-grade and minimal fix, and a clear GO / NO-GO — including on…
Use when recommending controls or evaluating whether a system is secure by construction — apply the classic security principles (least privilege, fail-safe defaults, complete…
Use when assessing founder conviction and "why you / why this" — separate a genuine haunting from FOMO.
Use before you write a line of demand copy or plan a launch — when the value seems "nice to have," when adoption is flat despite good messaging, or when nobody can answer "why…
Use when applying AI to selling — conversation/deal intelligence, AI-assisted research/prioritization, AI SDRs, AI-aware forecasting.
Use when a load-bearing fact is unknown — ask the founder the few questions you cannot responsibly default; propose defaults for the reversible ones; fill placeholders, never…
Use when handed a real deck, one-pager, or pitch to assess end to end — the orchestration that turns the seven reads into the ordered deliverable.
Use when you'd otherwise pitch features or send a comparison sheet — lead with a true, non-obvious insight that reframes the buyer's own problem and points to your strength…
Use first, before any copy — when positioning is unwritten, vague, aspirational, or being re-improvised per artifact.
Use when scoping any user-facing surface — require a whole-surface design up front; ship in slices, but each slice lands in its final place, nothing bolted on to be re-placed…
Use to keep research a habit, not a phase — small weekly touchpoints with real users, structured as an opportunity-solution tree, with every belief paired to the cheapest test…
Use pre-build, for a new idea, or at n=1 — is there a real market and will anyone pay? Run Mom-Test conversations on real prospects, hunt commitment + advancement, say "no one…
Use when scoping what to test on a non-trivial build — model coverage across the product's real dimensions (Structure, Function, Data, Integrations, Platform, Operations, Time) so…
Use at the acceptance gate — verify the build by doing the user's flow yourself end-to-end and confirming persisted state, not by checking that "the parts exist per spec" or that…
Use whenever the system spawns processes, sessions, jobs, workers, or connections (background daemons, tmux/PTY sessions, worker pools, cron jobs, subprocesses) — model the full…
Use when the system must change safely over time, when an invariant needs protecting, for "should we rewrite this?", or for a behavior-preserving refactor — protect the…
Use when a new field, surface, boundary, or piece of state is introduced — map every hop from user input to persisted state to read-back, find where data can silently drop, and…