Numbers that decide whether work goes live

On 12 March 2024, Interaction to Next Paint (INP) replaced First Input Delay (FID) as a Core Web Vital. FID measured only how long the first interaction waited to be handled. INP tracks every click, tap and key press in a visit and reports one of the slowest. A page that loads fast but responds slowly can no longer hide it.

The usual cause is long tasks on the main thread. Typical sources are a tag manager loading a dozen scripts, a consent banner that blocks input and a carousel that re-renders on every tap. Splitting long tasks and deferring what the first interaction does not need improves INP more than a faster server does.

What we check: field data as well as lab scores. A page can pass Lighthouse on a fast laptop and fail INP on the mid-range phones most of its visitors use. Before sign-off we read the 75th percentile from real-user data. We treat any third-party script that pushes INP past 200 ms as a defect.

Gmail’s sender guidelines set three conditions for anyone sending more than 5,000 messages a day to Gmail accounts. Authenticate the domain with SPF, DKIM and DMARC. Support one-click unsubscribe, with a visible unsubscribe link in the message body. Keep the spam rate reported in Postmaster Tools below 0.3 per cent, ideally below 0.1.

What we check: that every marketing message carries the List-Unsubscribe and List-Unsubscribe-Post headers from RFC 8058. We also check that an unsubscribe needs no login and that suppression runs before each send. This newsletter works the same way: double opt-in, an unsubscribe link in every issue and one-click headers for mail apps that support them.

The OWASP Top 10 for LLM Applications 2025 puts prompt injection first, as LLM01. It lists Excessive Agency as LLM06: an AI system given more functions, permissions or autonomy than its task needs. Neither is fixed by a better prompt. Both are tested for.

• Write the evaluation set before building the agent, including attempts to slip instructions in through documents and tool results.
• Agree the pass mark and what happens below it in advance, so a good demo cannot move it.
• Give each tool the narrowest permission it needs, and have a named person approve anything that cannot be undone.

In practice, each behaviour gets a small, versioned set of test cases. They cover answers the agent must give, actions it must refuse and data it must never reveal. The set runs whenever the prompt, model or tools change, and the results are kept with the release.

What we check: that the threshold was written down before anyone saw a result. A pass rate chosen after the fact is a description, not a test.

WCAG 2.2, a W3C Recommendation since 5 October 2023, added nine success criteria. One of them, Target Size (Minimum) at level AA, asks for pointer targets of at least 24 by 24 CSS pixels. Exceptions include a smaller target with enough space around it. The contrast minimum is unchanged: 4.5:1 for body text and 3:1 for large text.

Two more new criteria matter on any sign-up or checkout. Focus Not Obscured (Minimum) stops a sticky header or cookie banner from hiding the field a keyboard user is on. Accessible Authentication (Minimum) means a log-in cannot rely on remembering or transcribing something without help, such as a password manager filling the field.

What we check: the smallest controls, such as close buttons, pagination and links packed into tables, tested on a phone with a thumb. We design touch targets at 44 pixels, well above the 24-pixel minimum.