What should be preserved from the account before interaction?¶

Preserve identifiers for the account, session, page and device, plus visible security and provider references that may disappear after navigation.

Capture identity and current state¶

Record service, URL, username, email, handle, profile ID, tenant, workspace, page title, date, timezone and browser or device. Include transaction, conversation, document and case identifiers.

Capture visible sessions, linked devices, roles, recovery contacts, sign-in alerts and warnings without opening hidden details. Note whether the page is live, cached, offline or partly loaded.

Keep observation separate from reports¶

Take a full screen before close details. Do not navigate merely to build a comprehensive inventory; prioritise information already visible and volatile.

Record who controlled the device and what others say about the account separately from the display. Urgent protection may shorten the process, but preserve a baseline wherever delay does not increase harm.