AI app guides
Plan a document intake app that knows received from reviewed
Track file requests, access and review status without treating an uploaded document as automatically accepted.
Zocri · 2 min read · Sources checked
Name what the business is asking for
OWASP's file-upload guidance recommends restricting accepted types and sizes, validating files and limiting uploads to authorized users. Translate that guidance into a focused brief. A project intake app should request specific documents for a defined purpose. Tell users what is required, which formats are accepted and who will review the files. Avoid a general upload box that leaves the next step unclear.
Give each requested item its own state: not supplied, received, under review, accepted or needs replacement. An upload confirmation should say that the file arrived, not that the application or document has been approved. That distinction prevents an interface from making a decision no reviewer has made.
Define access before sharing links
Identify the uploader, assigned reviewer and any owner who needs oversight. Decide whether a customer can see only their own submission and whether other staff can see filenames, contents or neither. A convenient file link should not become an accidental public sharing mechanism.
Keep the document list understandable. Show the requested item, received date, current version and review state. If a user replaces a file, preserve the relationship to the request and decide what happens to the older version. Do not leave reviewers guessing which similarly named attachment is current.
Make rejection useful
When a reviewer requests replacement, provide a specific reason that helps the user act: unreadable scan, wrong document or missing page. Distinguish an unsupported file type from a problem with its content. The former is a technical refusal; the latter is a review decision.
Handle interrupted uploads honestly. Preserve the request even if its attachment fails, and show what remains incomplete. Test an oversized file and a file with a misleading extension in a safe environment. Ask the implementation reviewer to confirm that checks do not rely only on the browser's file picker.
Close the loop and the record
After all required items are accepted, show the next business step and its owner. Decide how long records should remain available under the organization's actual requirements, and who can remove or archive them. The builder should not invent a retention policy from a generic industry example.
Run a sample through upload, review, replacement and acceptance from separate accounts. Check that old links and unauthorized accounts cannot expose private files contrary to your access rules. A useful intake app gives both sides a clear status while keeping document handling an explicit part of the design.