← All cheatsheets
Business Analyst · #025 · August 17, 2026 · 2 min read

How do you write acceptance criteria that actually prevent rework?

A ticket that says 'works correctly' guarantees a sprint review that says 'that is not what I meant'. Given/When/Then with real before-and-afters, the five-point review checklist, and the three cases every story needs.

Get the free PDF

One page, print-ready, free to share. No signup needed.

Download the PDF

The ticket said the export should "work correctly". It shipped, it exported something, and the sprint review opened with the sentence every BA dreads: "that is not what I meant."

"Done" is a definition, not a feeling, and acceptance criteria are where the definition lives.

The format

  • Given the starting state, concrete: logged in, cart with 2 items, on the export page.
  • When exactly one action by one actor: clicks Export as CSV.
  • Then an observable, testable outcome: a CSV with all visible rows downloads within 10 seconds.
  • And chains sparingly. Five Ands means it is two criteria wearing one ID.

Before and after

the vague versionthe testable version
"export works correctly"Given a user with data, When they export, Then a CSV with every visible row downloads within 10s
"the page is fast"Given a cold cache, When the dashboard loads, Then content is visible in under 3s
"handles errors"Given the API is down, When the user saves, Then a retry message shows and no data is lost

The pattern in every fix: adjectives replaced by numbers, and outcomes something a test can check.

The review checklist

Run every criterion through five words: testable (QA could automate it from the text alone), observable, singular, edge-aware, solution-free (it says what happens, never which shade of blue the button is).

And learn the smells: user-friendly (friendly to whom, measured how?), fast and robust (adjectives are opinions), etc. (the missing cases are where the bugs live), as expected (expected by whom is the entire dispute).

The three cases that pay the rent

The happy path is one criterion. Production incidents come from the other three:

  • the empty case — zero rows, no data yet, a brand-new account
  • the error case — API down, timeout, invalid input
  • the permission case — wrong role, expired session, a shared link

A story with four criteria covering these is cheaper than the incident retro that writes them afterwards.

Write them before, or not at all

Criteria added at review time describe the demo, not the need, which is how every ticket passes while users keep complaining. Agree them before the first line of code with whoever will accept the work. If QA cannot write the test from the criterion alone, the criterion is not done.

The takeaway

Given/When/Then, numbers instead of adjectives, the three unhappy cases, agreed before coding. The print-ready PDF above is the format, the examples and the checklist on one page.

Frequently asked questions

What is the Given/When/Then format for acceptance criteria?
Given sets the concrete starting state, When is exactly one action by one actor, Then is an outcome you can observe and test. 'Given a logged-in user with data, When they click Export as CSV, Then a CSV with every visible row downloads.' Chain And sparingly: five Ands is two criteria.
What makes an acceptance criterion good?
It passes five checks: testable (QA could automate it from the text alone), observable (the outcome is visible to a user or a test), singular (one behavior), edge-aware (the empty, error and permission cases exist somewhere), and solution-free (it says what happens, not which button color).
When should acceptance criteria be written?
Before the first line of code, and agreed with whoever will accept the work. Criteria written at review time describe what got built rather than what was needed, which is how every ticket passes while users keep complaining. They are a contract, and contracts signed after delivery protect nobody.
What edge cases should acceptance criteria always cover?
Three at minimum: the empty case (zero rows, brand-new account), the error case (API down, timeout, invalid input), and the permission case (wrong role, expired session, shared link). The happy path is one criterion; production incidents live in these three.

Get the free PDF

One page, print-ready, free to share. No signup needed.

Download the PDF

More cheatsheets