Build → UAT handoff audits. Internal-only — clients receive evidence packs, never logins.
Single use · 15-minute validity · every redemption is alarmed to the team.