Why this matters
Definition of Done (DoD) alignment ensures every user story truly meets organizational quality, compliance, and release standards—not just stakeholder expectations. As a Business Analyst, you connect acceptance criteria with the team’s DoD so work is shippable without last-minute surprises.
- Reduce rework by catching gaps (tests, security, docs) early.
- Improve predictability: stakeholders know what “done” means.
- Enable consistent quality across squads and releases.
Concept explained simply
Acceptance Criteria (AC) describe how you will verify a story delivers value. The Definition of Done describes the universal quality gates every story must pass. Alignment means each story’s AC and delivery plan cover both value and quality gates.
Mental model
Think of a story as a package leaving a warehouse. AC are the address and contents checklist (does it solve the user need?). DoD is the shipping and safety protocol (sealed, scanned, insured, compliant). The package ships only if both are satisfied.
Typical items in a Definition of Done
- Code reviewed and merged to main
- Unit tests with agreed coverage (e.g., 70%+ where applicable)
- Functional QA passed
- UX/UI review or design QA passed
- Accessibility: WCAG 2.1 AA for new UI
- Security checks passed (linting/OWASP basics)
- Performance baseline not degraded
- Feature flag toggled off-by-default (if applicable)
- Docs updated (release notes, user help, API)
- Localization/internationalization handled (if applicable)
Worked examples
Example 1: Password reset
Story: “As a customer, I want to reset my password via email so I can regain access.”
Initial AC (incomplete):
- Given I enter a registered email, when I request reset, then I receive a reset email.
- Link expires in 30 minutes.
DoD gaps: no QA/tests, security, analytics, accessibility, docs. Aligned AC/notes:
- Reset email sent with single-use token; token invalid after first use.
- Unit tests cover success, invalid email, expired token.
- Security: rate limiting after 5 requests/hour; no email enumeration in UI messages.
- Analytics: event “password_reset_requested” and “password_reset_completed”.
- Accessibility: focus moves to confirmation; screen reader text provided.
- Docs: help article updated; release note prepared.
Example 2: Add to cart button color change
Story seems trivial, but DoD still applies.
Aligned items:
- Design QA: color meets brand and contrast ratio (WCAG AA).
- No performance regression from asset changes.
- Unit/UI test updated for visible state.
- Analytics unaffected or updated if event relies on CSS selectors.
Example 3: Export reports to CSV
Initial AC:
- User can export current report to CSV.
- CSV opens in Excel and Google Sheets.
DoD alignment adds:
- Large dataset tested (100k rows) with acceptable time.
- Memory/performance threshold not exceeded.
- Security: only authorized columns exported; PII masked as required.
- Feature flag for phased rollout; docs include column definitions.
How to align DoD with acceptance criteria: step-by-step
- List the story’s AC focused on user value.
- Pull the team/org DoD checklist.
- Map each DoD item to the story: is it applicable? If yes, add an AC or a “done note”.
- Call out N/A items explicitly to avoid ambiguity.
- Review with Dev, QA, UX, Security to confirm feasibility.
- Finalize AC and add them to the story.
Quick DoD-to-AC mapping template
- Testing: Unit, integration, e2e — which apply?
- QA signoff: What scenarios and devices/browsers?
- UX/Accessibility: Contrast, keyboard, focus, labels
- Security: authZ/authN, rate limiting, data exposure
- Performance: baseline, limits, data size
- Analytics: events, properties, validation plan
- Docs: user help, API, release notes
- Feature flag/rollout: strategy and default
- Localization: copy keys and translations
Exercises you can do now
These mirror the graded exercises below. Work through them here first. The quick test is available to everyone; only logged-in users get saved progress.
Exercise 1: Align a story to DoD
Org DoD (assume): code review, unit tests (70%+), QA signoff, UX review, analytics events, feature flag, docs updated, accessibility WCAG AA for new UI.
Story: “As a user, I want to reset my password via email.” Initial AC: 1) Email sent for registered address. 2) Link expires in 30 minutes.
- Task: List missing DoD items and rewrite AC so the story meets DoD.
Check yourself
Expect to add security (rate limiting, enumeration-safe messaging), tests, analytics, accessibility focus/labels, docs, possibly feature flag.
Exercise 2: Draft a DoD-alignment checklist
Scenario: Your team ships mobile and web features. Draft an 8–10 item checklist a BA can attach to each story to verify DoD alignment.
Check yourself
Include tests, QA, UX/accessibility, security, performance, analytics, docs, localization, flags/rollout, data migration if any.
Common mistakes and self-check
- Mistake: Treating DoD as optional for “small” stories. Self-check: Can the change ship without manual steps?
- Mistake: AC only describe happy paths. Self-check: Do AC include edge cases and N/A statements?
- Mistake: Forgetting analytics or docs. Self-check: Is there a measurable event and user-facing explanation?
- Mistake: Vague quality terms ("fast", "secure"). Self-check: Replace with measurable thresholds or specific controls.
- Mistake: Not involving QA/UX/Sec early. Self-check: Did you validate feasibility and coverage with specialists?
Practical projects
- Retrofit: Take 3 old stories that caused rework. Add the missing DoD-aligned AC and note how they would have prevented the issue.
- Checklist pilot: Roll out your checklist to one squad for 2 sprints. Track defects escaping to QA and after release.
- Analytics validation: For one released feature, verify events exist, fire correctly, and have documentation. Propose AC to enforce this going forward.
Who this is for
- Business Analysts and Product Owners in agile teams
- QA-minded analysts and junior PMs looking to standardize quality
- Engineers who want clearer acceptance criteria
Prerequisites
- Basic understanding of user stories and acceptance criteria
- Familiarity with your team’s workflow (code review, QA, release)
- Awareness of your org’s compliance/security standards
Learning path
- Write AC from user value (Given/When/Then).
- Attach DoD and map each item to AC or done notes.
- Run a triad review (BA, QA, Dev, plus UX/Sec as needed).
- Pilot your checklist; refine with data (defects, rework).
- Institutionalize: add to story templates and Definition of Ready.
Mini challenge
Take a current backlog story. In 10 minutes, add DoD-aligned AC covering: tests, accessibility, analytics, docs, and one security control. Ask a developer and tester to poke holes in it. Iterate once.
Next steps
- Adopt a standard DoD-to-AC mapping template across your team.
- Measure impact: track escaped defects and lead time before/after.
- Revisit quarterly as your DoD evolves (new tooling, new risks).
Quick Test
Take the quick test below. Everyone can take it for free; only logged-in users have their progress saved.