Use when you have findings to report — grade each by real-world risk (P0–P3) with a specific minimal remediation, block only real exploitable harm, and name accepted risk out loud.
Use when gauging how urgent the pain is, what the value is worth, or how to price/package — probe willingness-to-pay directly and quantify the cost of doing nothing.
Use after any incident (or near-miss) — write a blameless postmortem that finds the systemic/contributing causes, not a person to blame, and produces tracked action items so the…
Use when there's more worth building than time to build it, or two good options compete — make the tradeoff explicit, pick one, and say what you're NOT doing and why.
Use when deciding what to say where — a cold ad vs. a homepage vs. a pricing page vs. a re-engagement email — or when copy is pitching the offer to people who don't yet know they…
Use when deciding how much process a piece of work needs — match ceremony to stakes; full rigor for one-way doors, a lean path for a contained fix.
Use before calling your own change done, and when reviewing someone else's PR — review against scope, conventions, and what could break; be useful and specific, not a nitpick gate.
Use when a vulnerability is reported from OUTSIDE the team (a security researcher, a user, a bug bounty, an embargoed upstream CVE) — triage it without shooting the messenger,…
Use when laying out any screen or composing a set of elements — make the eye go where it should. Establish visual hierarchy (one focal point, deliberate scan path), group with…
Use at the ship gate for any release — enforce one sanctioned scripted door to prod, a rollback you have actually tested, no leaked secrets, no regressed control, and the…
Use when output, status, notifications, or system messages are scattered across multiple places (panes, channels, logs, replies, toasts, emails) — consolidate them into one…
Use when a build is proposed with no path to reach users — force distribution (channel + activation + retention loop) into the product decision.
Use when filing a finding — write the bug report as a persuasive document that gets it fixed (Kaner's bug advocacy): exact repro, expected vs actual, severity, and the expectation…
Use at the end of an evaluation — would this pitch still be on your mind at dinner, or does it blur into the other AI/SaaS pitches? Name the one compounding idea, and the single…
Use for build-vs-buy, adopting a new framework/database/language, or "should we use X" — apply the innovation-token test; default to the well-understood; a stack only the AI…
Evidence group skill. Runs direct end-user interviews to saturation. Gates on access — halts if discovery-context says user_access is none or proxy-only.
Use when generating or accepting AI/LLM-written code — treat the model as a fast junior, not an oracle: give it context, then verify every line; never ship plausible-but-wrong…
Use when the long-term vision is big but the entry point is fuzzy — find the credible first wedge that expands.
Use when there's a technical or scientific claim under the pitch — push on the mechanism in proportion to how load-bearing it is.
Use at the acceptance gate — verify the build by doing the user's flow yourself end-to-end and confirming persisted state, not by checking that "the parts exist per spec" or that…
Use when the people who sell or talk to customers (sales, founders, support, partners) need the message in usable form — pitch deck, one-pager, demo script, objection handling,…
Use to land your review as a durable artifact — the attack surface reviewed, findings at file:line (or "none"), the P-grade and minimal fix, and a clear GO / NO-GO — including on…
Use when someone demands "100% uptime," when arbitrating ship-speed vs stability, or when defining how reliable a service must be — set an SLI/SLO and an error budget so…
Use when advancing a deal toward commitment — build a Mutual Action Plan working backward from go-live (including legal/procurement), drive each step, and ASK for the commitment…
Use when applying AI to selling — conversation/deal intelligence, AI-assisted research/prioritization, AI SDRs, AI-aware forecasting.
Use before building on or committing to a vendor/runtime (cloud, PaaS, serverless, queue, DB, third-party API) — read the actual pricing, runtime-limits, and execution-model docs…
Use when multiple teams/engineers each reinvent deploys/infra badly, or when building shared platform capability — make the safe, observable, compliant way the EASY way (a paved…
Use when scoping what to test on a non-trivial build — model coverage across the product's real dimensions (Structure, Function, Data, Integrations, Platform, Operations, Time) so…
Use before you test anything — build your own model of "correct" from the brief, spec, and user journeys so you have a basis to call something a bug, and state which expectation…
Use whenever copy is drifting into a feature list, spec dump, or internal jargon — onboarding, a feature page, a release note, a tagline.
Use when running a founder meeting or generating the questions you'd ask — the texture of the conversation, not a diligence checklist.
Use when performance matters, something is slow, or a job is failing/timing out — measure before optimizing, profile to find the real bottleneck, parallelize independent work and…
Use when a load-bearing fact is unknown — ask the founder the few questions you cannot responsibly default; propose defaults for the reversible ones; fill placeholders, never…
Use to validate a feature against real users — build a persona dossier and walk that specific person through the journey to find where it breaks for THEM.
Use before recording any new person/entity/insight/belief — search what already exists and converge new signal onto it; coin a new node only when nothing fits.
Use when the message is aimed at "everyone," when one product serves multiple distinct buyers, or when you need to pick the beachhead segment to lead with.
Use when the system must change safely over time, when an invariant needs protecting, for "should we rewrite this?", or for a behavior-preserving refactor — protect the…
Use to sequence your work on a change — make it work, then make it right, then make it fast, in that order; keep one concern per change; don't tangle a feature with a refactor.
Use when designing a module/function/API or when tempted to add abstraction "for the future" — reduce complexity; build deep modules with simple interfaces; the simplest thing…
Use before writing any copy, when copy sounds like the team talking to itself, or when you need the raw language for headlines and messaging.
Use to decide where to spend a finite testing budget — prioritize by risk (likelihood × impact), hammering data loss, auth, the core flow, and money first, and right-size the…
Use when a call is hard-to-change or a one-way door (persistence, boundaries, public interfaces, the build/deploy path, a dependency) — record an ADR; immutable once accepted,…
Use when assessing defensibility and timing — why won't the incumbent (or a well-funded lab) just do this, and what's the durable moat once the easy parts commoditize.
Use the moment you think you've found a bug — reproduce it yourself with exact steps (never theorize from reading code), make an intermittent failure deterministic, and grade its…
Use when designing motion, feedback, or any single interactive moment (a toggle, a like, a save, a panel opening).
Use when reporting status or accepting work — keep the board honest (in-progress only if truly in progress, done only if verified done) and CHECK the definition of done against…