Pick a state-changing action such as archiving a project. Pin a commit and trace the interface event through the server route, authorization check, data update, and audit record. Mark where identity comes from and which component decides whether the request proceeds.
Record branches and dependencies
Write one row each for success, denied access, and a failed write. Capture the function, inputs, output, and side effects. Check whether authorization runs on the server, a database error prevents a success response, and an audit record depends on background work. Attach code locations to the diagram.
Verify with controlled fixtures
Use an administrator and a read-only test user in a disposable project. Use Webapp Testing to organize the browser observations, and exercise the denial branch through existing API tests. Confirm that an allowed archive persists after reload and a denied action preserves state.
Preserve the trace for the next change
Distinguish observed paths from paths inferred from source. List the asynchronous work or transaction boundaries that still need investigation. Include the fixture and commit in the handoff.