| Access, permissions or configuration | Verify account state, documented settings and known workflow. | User/account context, screenshots, exact error, actions attempted. | Admin or product owner when permissions are restricted. | Support can proceed only within approved access and documented rules. |
| Known product behaviour or known issue | Confirm match, provide approved guidance and record affected context. | Version/module, steps, known-issue reference, workaround used. | Product owner for status updates or changed guidance. | No unsupported workaround or product promise should be invented. |
| Suspected defect | Reproduce where possible, rule out common causes and prepare escalation. | Steps to reproduce, environment, logs or identifiers available to support. | Engineering or QA owns code-level diagnosis and fix decisions. | Bug fixing is not included unless separately scoped. |
| Integration / API failure | Check documented integration settings and gather transaction context. | Endpoint/action, timestamp, request identifiers, error message, dependency state. | Client engineering, integration owner or third party may be required. | Complex integration debugging may require specialist scope. |
| Wider incident or outage signal | Recognise pattern, avoid duplicate diagnosis, follow agreed incident communication path. | Affected users, timing, symptoms, common dependency and ticket links. | Incident commander / infrastructure / engineering remains accountable. | Operational incident authority is not assumed by default. |
