Ask what happens to an unsent message when the session expires
A customer workspace can appear straightforward while somebody is signed in and working quickly. A longer task reveals another requirement: can the person recover their own unfinished work after authentication expires, without exposing it to someone else or pretending it was submitted?
This fictional procurement comparison concerns a customer preparing a detailed question about a workpack. The organisation permits temporary draft retention under a defined policy. It has not authorised sending the message until the customer deliberately submits it.
Specify the task before comparing the products
Customer A signs into workspace W-18, opens workpack P-42 and writes an explanation of the preparation question. The session expires while they consult a paper document. When they return, they need to authenticate again and continue their own unsent message.
The required outcome is specific: preserve the draft under the approved retention arrangement, associate it with the same author and workspace, require renewed authentication before exposing it, and distinguish recovery from submission. A product that silently sends the draft to avoid losing it would fail the task.
The organisation also requires another person using the same device to be unable to retrieve A's draft merely by opening the form. Shared-device behaviour is part of the comparison, not an afterthought.
Inspect two supported behaviours
The two imagined providers document different operations in the proposed account configurations:
| Requirement | Provider Fern | Provider Kauri |
|---|---|---|
| Expired session during this task | Redirect to sign-in and discard the unsent form state | Hold an author-bound draft under the configured retention policy |
| Same person authenticates again | Open a fresh message | Offer recovery of that person's draft for W-18/P-42 |
| Another person signs in | No former draft to recover | Deny access to the former author's draft |
| Recovery itself sends the message | No | No |
These are stipulated findings from the fictional providers' supported test arrangements. They are not generic claims about products with similar names or features. The organisation examines both the documented contract and the actual demonstration supplied for the proposed configuration.
Complete the same-author recovery
In the Kauri trial, A returns after expiry and signs in again. The recovery view identifies the draft's workspace and workpack. A retrieves the original unfinished wording, checks it, adds the missing detail and deliberately submits it.
Before that final action, the receiving team has no submitted enquiry from this draft. After it, the trial records one submitted message associated with W-18/P-42. Recovery did not create an earlier duplicate or silently convert a private draft into a staff-visible message.
The approved retention policy determines how long an unsubmitted draft may remain and how the person can discard it. A demonstration of recovery is not permission to retain every partial message indefinitely or collect text before the organisation has established an appropriate arrangement.
Check the different-person boundary
The second test expires A's session again while a fresh draft exists. Person B then authenticates on the same test device. B cannot retrieve A's draft, and the form does not prefill with A's message.
B prepares an independent question for a workspace they are authorised to use. That draft belongs to B and does not replace or acquire A's content. An attempted direct retrieval using A's draft reference is denied by the supported service, not merely hidden from the menu.
A later returns under the permitted retention conditions and can recover their own still-unsent draft. The trial thereby checks both isolation and continuity. It does not rely on a shared browser remaining permanently signed into the same person's account.
Choose the capability that the requirement needs
Fern's supplied configuration cannot preserve the long message through this expiry path. The organisation records that limitation rather than assuming a custom script can override the provider's authentication flow safely.
Kauri passes the bounded same-author recovery, other-user denial and deliberate-submission tests. The owner therefore selects it as the preferred candidate for this task, conditional on the remaining supplier, data-handling and wider integration review. The comparison has not established that every portal function or every security requirement is complete.
If the organisation's retention policy prohibited draft storage, the requirement and decision would need to change. A technical feature should not be enabled solely because it appears convenient in a demonstration.
Ask for evidence that distinguishes the states
A useful supplier review should show an unsent draft, an expired session, renewed authentication, a denied unrelated user and a single deliberate final submission. Request the account and configuration assumptions behind that demonstration.
Record what can be recovered, who may recover it, when it expires and which event actually creates the staff enquiry. The customer-facing wording should reflect those facts. “Your message has been sent” is wrong while the system is only preserving an unfinished draft.
Use this question when assessing customer portal work. Bring the real task length and approved information policy to the project conversation, with invented records for the initial review.