Start with a transition map
Dhangadhi Service Bus includes applications routed between municipal roles. That domain suggests a useful testing question: what must remain true when ownership changes? This article proposes tests; it does not describe an executed production audit.
List each state, the actor allowed to move it, the required documents, and the side effects. Forwarding, sending back, approving, and rejecting are separate transitions with different preconditions. Confirm the actual rules with the product team before creating expected results.
Use a small, explicit permission matrix
For an illustrative fixture, create a citizen, a reviewing officer, and an approver. Give each a separate test account. Check the same application through each account, including direct API requests in an authorized test environment. A hidden button alone does not establish that the operation is protected.
- Citizen attempts an officer-only transition: reject it and preserve state.
- Reviewer sends an application back: record the reason and notify the correct owner.
- A second officer acts on an outdated screen: reject or reconcile the stale change according to the agreed rule.
Follow the side effects
After a transition, inspect the status, assignee, audit entry, and notification together. If the browser reports a timeout, fetch the application again before deciding the operation failed. A retry must not create a second decision or deliver an unrelated notification.
Evidence should include the starting state, account role, request identifier, resulting state, and observation time. Use synthetic records and redact tokens from attachments. A report becomes actionable when another engineer can replay the exact transition.
Choose release evidence
For this exercise I would prioritize unauthorized transitions, lost applications, and inconsistent decisions. A release summary should state which roles and transitions were covered, what remains blocked, and what was not tested. A green list of button clicks cannot substitute for that coverage.
Information Care’s articles supplied the broader civic-service and data-protection context. The fixtures, scenarios, and QA interpretation here are original testing proposals.