# Staging Acceptance Checklist

- Database migrations and views apply without errors.
- CEO, manager, employee, finance, legal, administrator, assessor, and client accounts see only permitted menus and records.
- Cross-client, cross-project, cross-office, and cross-department access attempts return 403 or empty scoped results.
- Maintenance mode blocks ordinary users while health checks remain available.
- Rate limiting produces HTTP 429 after the configured threshold.
- Uploads enter quarantine, reject disallowed MIME types, and cannot be downloaded before a CLEAN scan.
- Cloudflare origin traffic resolves the correct visitor IP without trusting spoofed headers.
- CSP produces no blocking errors for approved application assets.
- Backups verify and a staging restore rehearsal succeeds.
- Mobile screens work at 320, 375, 768, 1024, and desktop widths.
- No critical or high-severity security findings remain open.