Write one clear mission
A charter gives direction without scripting every action. Write one sentence that names the target, the investigation, and the quality risk. A narrow mission helps the tester make deliberate choices during the session.
Do not combine unrelated goals in one charter. Split authentication, pricing, and accessibility investigations when they need different data, tools, or evidence.
Name the feature, journey, API, or data flow under investigation.
State what you will explore or evaluate.
Connect the mission to a customer, business, or technical risk.
Keep the mission achievable within the session timebox.
Prepare data and useful variations
List the states and data that can expose important behavior. Include normal use, boundaries, interruptions, invalid input, permissions, and changes made by another actor.
Use heuristics as prompts, not as a mandatory script. Follow an unexpected observation when it can reveal a more important risk. Record why you changed direction.
Prepare accounts with different roles and lifecycle states.
Identify boundary values and meaningful data combinations.
Include interruption, retry, refresh, and concurrent-change ideas when relevant.
Confirm which tools can capture logs, requests, queries, or screenshots.
Close with a useful debrief
A session is not complete when the timer ends. Summarize what you covered, what you learned, and what remains uncertain. Separate defects from questions and new risks.
Use the debrief to decide the next action. The result can support a defect report, another charter, an automated check, a product question, or a release-risk discussion.
Mission: Explore [target] with [data or technique] to evaluate [risk].
Timebox: 60 minutes
Setup: [environment, build, account, data]
Cover:
- Primary journey and important alternatives
- Boundaries and invalid states
- Interruptions, retries, and state changes
- Permissions and sensitive data
Capture:
- Notes and observations
- Defects and questions
- Requests, logs, queries, or screenshots
- Areas covered and not covered
Debrief:
- Important findings
- New or changed risks
- Remaining uncertainty
- Recommended next action