Create a sequence diagram by describing who sends each message and in what order. Include the response and failure paths you need; unspecified behavior requires clarification.
Choose one scenario
Describe the successful path before adding alternatives. Name the participants consistently; a browser, a server and an external identity provider are separate actors even if the interface makes them appear seamless. Specify which messages are synchronous, which are callbacks and which happen in the background.
In an authorization-code flow, the server exchanges the code for tokens. A diagram that sends a server secret from the browser describes a different and potentially unsafe implementation.
Make failures observable
Add an alternate branch for the condition that changes the interaction: a denied authorization, expired code or unavailable service. Show the response visible to the initiating participant. An error floating beside a lifeline does not explain which request produced it.
Ask “What does the browser receive when the token exchange fails?” and ensure the revision answers that question without creating a successful session in the same branch.
Review order and ownership
Read messages from top to bottom and confirm that prerequisites happen first. Check where the session is created, who owns the credentials and where retries belong. The agent illustrates the protocol you describe; it does not validate a live authentication service.
Use architecture diagrams for service boundaries and flowcharts for the user-facing decisions around the interaction.
Make it about your work
Edit this starting prompt, then send it when you are ready.