Plan the shared-device handover before staff go mobile

A device used by several staff members introduces a different workflow from a personal phone. The application needs to know who is acting, which records they can see and what happens when a shift ends.

Describe the actual handover

A hypothetical Costa Rican service team might pass a tablet between reception and a visiting coordinator. Decide whether each person signs in individually and whether a partly completed task can transfer. A shared password hides responsibility and makes staff changes harder to manage.

Keep local information deliberate

If the application saves drafts or files on the device, agree what remains after logout and how it is protected. The convenience of offline work should not quietly create an unmanaged copy of customer information.

Try the end of a shift

Use fictional records. Start a task, change user and check what the second person can see. Include a lost session and a device that has not connected recently. Record the expected behavior before implementation.

OWASP's authentication guidance describes controls that require implementation-specific review. Your organization defines the staffing and access rules. A mobile application engagement should include the shared-device workflow along with the screen design.