--- title: "Notifications checklist: all 28 rules ยท Agent Wranglers" url: https://agentwranglers.se/playbook/notifications/checklist updated: 2026-10-20 licence: "All rights reserved" --- # Notifications checklist By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20. Every rule in the notifications playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. **For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers notifications playbook: https://agentwranglers.se/playbook/notifications/checklist`. ## Channels and preferences - [ ] **Required** [Keep every notification type in one catalogue](https://agentwranglers.se/playbook/notifications/channels-and-preferences/notification-catalogue): Define every notification type once, in code, with its category, allowed channels, default channels and urgency. Sending code accepts only types from that catalogue. - [ ] **Required** [Ask before any marketing message](https://agentwranglers.se/playbook/notifications/channels-and-preferences/marketing-consent): Send marketing on a channel only after the person opted in to that channel. Keep the proof, and keep marketing out of transactional messages. - [ ] **Required** [Let people choose per type and channel](https://agentwranglers.se/playbook/notifications/channels-and-preferences/notification-preferences): Let each person turn every notification type on or off per channel, and read those choices at send time. - [ ] **Required** [Send one message per event](https://agentwranglers.se/playbook/notifications/channels-and-preferences/one-message-per-event): Deliver each event to a person on one channel first, and move to the next channel only if they have not seen it. Never send the same news on every channel at once. - [ ] **Required** [Hold messages during quiet hours](https://agentwranglers.se/playbook/notifications/channels-and-preferences/quiet-hours): Hold every non-critical push and text until the recipient's quiet hours end, in the recipient's own time zone. - [ ] **Required** [Cap how many messages one person gets](https://agentwranglers.se/playbook/notifications/channels-and-preferences/notification-rate-caps): Set a maximum number of push and text messages per person per day, and per type per hour. Fold the overflow into a digest or the inbox. - [ ] **Required** [Never text or push customers from test systems](https://agentwranglers.se/playbook/notifications/channels-and-preferences/test-notification-sinks): Outside production, send push and text messages only to an allow list of test devices and phone numbers. Drop every other recipient before the provider call. - [ ] **Recommended** [Batch small updates into a digest](https://agentwranglers.se/playbook/notifications/channels-and-preferences/notification-digests): Collect low-urgency notifications over a window and send one summary, instead of one message per event. ## Push notifications - [ ] **Required** [Ask for permission after a clear action](https://agentwranglers.se/playbook/notifications/push-notifications/push-permission-in-context): Ask for notification permission only after the person clicks a control that says what they will get. Never ask on page load. - [ ] **Required** [Send web push with VAPID and an encrypted payload](https://agentwranglers.se/playbook/notifications/push-notifications/web-push-vapid): Send web push through each subscription's push service with VAPID keys (RFC 8292) and an encrypted payload (RFC 8291). Never build your own polling or socket for background alerts. - [ ] **Required** [Use the current APNs and FCM interfaces](https://agentwranglers.se/playbook/notifications/push-notifications/apns-fcm-current-apis): Send to Apple devices through APNs over HTTP/2 with token-based auth, and to Android through the FCM HTTP v1 API. Never use the retired legacy FCM API. - [ ] **Required** [Delete dead subscriptions and tokens at once](https://agentwranglers.se/playbook/notifications/push-notifications/prune-push-subscriptions): Delete a push subscription or device token as soon as the service says it is gone. Remove tokens the app has not refreshed for 270 days. - [ ] **Required** [Keep push payloads short and safe on a lock screen](https://agentwranglers.se/playbook/notifications/push-notifications/push-payload-privacy): Put no secrets, codes, health or money details in a push. Show a neutral line and the details only after sign-in. Keep the payload JSON at or under 3,993 bytes. - [ ] **Recommended** [Give every push a lifetime and a topic](https://agentwranglers.se/playbook/notifications/push-notifications/push-ttl-and-collapse): Set how long each push may wait for an offline device. Give updates a topic, so a newer push replaces the older one. - [ ] **Recommended** [Open the exact page the push is about](https://agentwranglers.se/playbook/notifications/push-notifications/push-deep-links): A tap on a notification opens the page it is about, reuses an open tab when there is one, and marks the item as read. ## Text messages - [ ] **Required** [Register every sender before you send](https://agentwranglers.se/playbook/notifications/text-messages/sms-sender-registration): Send texts only from numbers or sender IDs registered for that country and use case. Never send business texts from an unregistered number. - [ ] **Required** [Confirm each text opt-in](https://agentwranglers.se/playbook/notifications/text-messages/sms-opt-in-confirmation): After an opt-in to recurring texts, send one confirmation. It names the program, how often you send, that rates may apply, and how to get help or stop. - [ ] **Required** [Stop at the first STOP](https://agentwranglers.se/playbook/notifications/text-messages/sms-stop-keywords): Treat STOP and the other standard opt-out words as an instant opt-out for that sender. Answer HELP with who you are and how to reach you. - [ ] **Required** [Guard text sending against SMS pumping](https://agentwranglers.se/playbook/notifications/text-messages/sms-pumping): Limit who can make you send a text, to which countries, and how often. SMS pumping fraud sends your codes to premium numbers and bills you. - [ ] **Required** [Store phone numbers in E.164](https://agentwranglers.se/playbook/notifications/text-messages/e164-phone-numbers): Parse every phone number with a phone number library, and store it in E.164 format with its country. - [ ] **Recommended** [Format code texts for automatic fill](https://agentwranglers.se/playbook/notifications/text-messages/sms-code-autofill): End every sign-in code text with the origin-bound line `@example.com #123456`, using the exact host of the sign-in page. - [ ] **Recommended** [Keep each text to one segment](https://agentwranglers.se/playbook/notifications/text-messages/sms-segments): Keep each text within one segment, and test every template for its encoding and length. - [ ] **Recommended** [Track what happened to each text](https://agentwranglers.se/playbook/notifications/text-messages/sms-delivery-status): Record the provider's delivery status for every text through a signed callback, and stop sending to numbers that keep failing. ## In-app notifications - [ ] **Required** [Store every notification in a server-side inbox](https://agentwranglers.se/playbook/notifications/in-app-notifications/notification-inbox): Write every notification to an inbox table on the server first, and let push, text and email point to that row. The browser never holds the only copy. - [ ] **Required** [Announce new items without stealing focus](https://agentwranglers.se/playbook/notifications/in-app-notifications/accessible-inbox): Announce new notifications to screen readers through a polite live region, and never move focus or open a dialog for them. - [ ] **Recommended** [Keep read state the same everywhere](https://agentwranglers.se/playbook/notifications/in-app-notifications/read-state-sync): Mark an item read once on the server, and clear it in every open tab, every device badge and any pending reminder. - [ ] **Recommended** [Deliver new items live and catch up after a gap](https://agentwranglers.se/playbook/notifications/in-app-notifications/live-inbox-updates): Push new inbox items to open pages over one live connection, and fetch what was missed after every reconnect. - [ ] **Recommended** [Delete old inbox items on a schedule](https://agentwranglers.se/playbook/notifications/in-app-notifications/inbox-retention): Delete inbox items after a fixed time, such as 90 days, and show the limit in the inbox.