A long supplier application can expire while someone gathers documents or uses assistive technology. Commission the warning and extension path as part of authentication, separately from saving a draft. A saved draft does not prove the user received enough time to complete the current task.
Primary evidence and claim boundaries
WCAG 2.2.1 offers turn-off, adjustment or extension routes, with defined exceptions. The extension route includes at least20 seconds to respond and at least10 extensions; security-related timeouts are not automatically exempt. Primary reference · Read 18 October 2026.
Filled acceptance example
Original synthetic teaching scenario, not a client case, provider integration test or business result. The example policy needs the actual owner’s approval; scroll the table on narrow screens.
| Input and state | Declared check | Expected output and decision |
|---|---|---|
| Synthetic session expires at 10:00:00 | Warning begins09:59:30 | 30 seconds to act; simple extension control available |
| Same expiry; warning09:59:50 | Only10 seconds remain | Fails this selected extension route |
| User requests extension number 10 | Policy allows10 extensions | Still permit the tenth, not only nine |
| Session already expired | Attempt extension | Do not silently bypass authentication; offer approved recovery |
Practical handover procedure
- List each timer, its owner and any claimed exception. Have the security/accessibility reviewers choose a supported route rather than adding a warning to every timer without analysis.
- Replay warning time, minimum response period and extension count using a controllable test clock. Record focus, announcement and the fields retained after extension.
- Exercise expiry separately from draft recovery. Confirm the server agrees with the renewed deadline and never treats a local countdown as new authority.
Interpret the outcome
The first row has a30second opportunity; the second has10 and fails the selected route even if its button works. The tenth-extension boundary prevents an off-by-one acceptance. A security reviewer may identify an applicable exception, but that needs its own justification and cannot be inferred from the word “secure”.
Acceptance decision
Require a usable supported timing route and consistent client/server expiry. Keep authentication recovery and retained data within the approved security policy.
Limits and unverified work
Synthetic timing, no login, token change or timeout-policy modification. The example does not weaken MFA, extend third-party credentials or certify WCAG conformance.
Download the filled bilingual acceptance record — Contains the inputs, steps, expectations and limits. This is a teaching record, not an executable production integration.