All Playbooks/Project preparation

PLAYBOOK 06 / PROJECT PREPARATION

Access control, staging, and release approval

Set up who can change what, how changes are checked, and what to do if a release has problems.

6 chapters4 steps1 worksheet4 minute read

Oura Works · Updated October 2, 2026

CHAPTER 01 / BEFORE YOU BEGIN

Prepare your materials. Define the deliverables.

Website owners, developers, and operational responsibilities working with internal teams or vendors.

Starting materials

  • List of system and account owners
  • Available test environments
  • List of changes to be released

What you will prepare

Access matrix, release checklist, and recovery plan.

Use it as material for decisions and discussions, then adjust the work limits to your conditions.

Starting from one page, one process, or one most important need. Note unknowns as questions; Don't force answers just to make the worksheet look finished.

CHAPTER 02 / WORK STEPS

Work in a clear order.

01

Inventory of systems and their owners

Note the domain, hosting, CMS, repository, analytics, and form submission services. Keep owner accounts under the control of the business, not just one vendor. Grant access as assigned and use MFA when available. Do not store passwords, tokens, or recovery codes in the general brief or this practice sheet.

The output of this stepList of systems, owners, roles, and how to revoke access.
02

Separate testing from production

Staging is used to review changes before they are applied to the public website. Limit access and use test data, not unprotected copies of customer data. Setting noindex alone is not access control. Configuration differences between staging and production need to be noted so that test success is not misinterpreted as a guaranteed release.

The output of this stepTest environment with data, access, and configuration differences.
03

Determine who gave consent

Content owners check facts and copy; developers check technical changes; operations check the inquiry receipt process. For each change, note the version, scope, test results, and approving parties. Separate emergency fixes from routine changes, but still document decisions and check-ins afterward.

The output of this stepNote approval of the version to be released.
04

Prepare recovery before release

Define conditions that require rollback, backup location, person responsible, and sequence of actions. Make sure the backup can be restored in a suitable environment. After release, check priority pages and important transactions or forms. This plan reduces risk; it does not guarantee zero downtime or total security.

The output of this stepRollback plan and checklist after release.

CHAPTER 03 / EXAMPLE SURGERY

Connect steps to real decisions.

Quote form change exercise: the team changed the required fields, not the entire website. Release decisions are based on the acceptability of the form as well as the clarity of the message for users.

Editorial illustrations for Access control, staging, and release approval; not client documentation
Workflow illustration. Labels and data on images are examples, not client results or Oura certification.
Practice examples · Access control, staging, and release approval
RoleWhich is reviewedProof before release
Content ownerLabels and form instructionsCopy version approved
DeveloperValidation, response and accessSuccess and failure test results
OperationalAcceptance and follow-upInquiry test accepted goal system
Responsible for releaseVersions, schedules and rollbacksApproval and backup available
Try implementing it

Replace the example lines with your business conditions. Mark information that already has evidence, that is still an assumption, and that needs to be asked of the person in charge.

CHAPTER 04 / REVIEW POINT

Avoid decisions that seem right, but have not been tested.

Using one shared admin account

Separate accounts according to platform capabilities so that responsibilities and access revocation are clearer.

Assuming a successful backup means a successful restore

Test restore and check the results. The status of the backup file alone is not enough.

If a decision impacts costs, access, data, or other teams' work, list the parties who need to approve it. Explain the evidence that is available and the extent of information that remains to be examined.

CHAPTER 05 / WORKBOOK

Make your plans here.

Fill in concisely and specifically. For information that is not yet available, write who needs to be asked for confirmation. These notes are not sent by the Playbook feature to Oura; download before the tab closes.

WORKSHEET / 06Personal notes in this tab

Do not enter passwords, access tokens, or personal customer data. Temporary storage follows the browser tab session, not the Oura account.

Download PDF guideDownload blank guide (.md)

CHAPTER 06 / BEFORE SUBMISSION

Check your job readiness.

This checklist records the tasks you marked. It is not an audit score, certification, or automatic assessment of a website.

Job checklist0 out of 5 marked

Frequently asked questions

Does staging have to be synonymous with production?

Similarities help testing, but differences often remain. Note differences and perform production checks after release.

Does approval slow down all changes?

Set review levels based on impact. Minor changes and critical changes can have different paths documented.

Referral & usage limits

References checked on October 2, 2026. Steps, examples and worksheets are Oura editorial formulation with the help of AI and public references. Examples are not client results. The guide does not guarantee business results and does not replace a dedicated examination of your systems.

OWASP — Authorization Cheat Sheet

Turn the initial plan into a clear scope.

Bring your notes with you when discussing needs with the Oura team.

Discuss business needs
WhatsApp