"As a user, I want to log in, so that I can access my account" is a template filled in correctly and still a nearly useless story — it says nothing a reasonable person didn't already assume. A story earns its place on the backlog by what it forces the team to actually decide, not by matching the format.
4 min read
The standard user story format —
As a [role], I want [capability], so that [benefit]
— is a scaffold for a conversation, not the deliverable itself. Ron Jeffries, one of the format's originators, described the story card as standing for "Card, Conversation, Confirmation" — the card is a placeholder that reminds the team to have a real conversation about what's needed, not a specification that replaces that conversation. A team that writes a grammatically correct story and treats the format itself as "done" has skipped the part that actually mattered.
A widely-used checklist (coined by Bill Wake) for whether a story is actually well-formed:
Acceptance criteria are the specific, testable conditions that must be true for a story to be considered done — and they're what turns "I want to log in" from a vague aspiration into something a team can build and a reviewer can objectively verify, rather than argue about after the fact.
A weak story:
As a user, I want to log in, so that I can access my account.
The same story with real acceptance criteria:
As a registered user, I want to log in with my email and password,
so that I can access my account.
Acceptance criteria:
- Given valid credentials, the user is redirected to their dashboard
- Given an incorrect password, an error is shown without revealing
whether the email exists in the system
- After 5 failed attempts within 15 minutes, the account is
temporarily locked and the user is notified
- The password field masks input by default, with a toggle to reveal it
- Login works correctly on both desktop and mobile viewport widths
Every one of these criteria is something a developer can build directly against and a reviewer can check off objectively — no argument about whether "log in" was actually delivered, because "delivered" has a concrete, agreed-upon meaning stated up front, not decided retroactively when someone disagrees.
Especially for criteria involving specific scenarios or edge cases, the Gherkin style (Given/When/Then) makes the structure explicit:
Given a user with a locked account
When they attempt to log in with correct credentials
Then they see a message explaining the account is locked
And a link to unlock via email verification
This format is popular specifically because it maps cleanly onto both a plain-English acceptance criterion a Product Owner can read and approve, and an automated test scenario a QA engineer or developer can write directly from — the same sentence serves as the spec and (often nearly verbatim) as the test.
A story that fails "Small" or "Estimable" usually needs splitting, and the common trap is splitting by technical layer instead of by user-visible slice:
BAD split (by layer — neither half is independently valuable):
- "Build the login API endpoint"
- "Build the login UI"
GOOD split (by user-visible slice — each is independently shippable):
- "Log in with email + password" (happy path only)
- "Show a helpful error for incorrect credentials"
- "Lock the account after repeated failed attempts"
The bad split produces two stories where neither, on its own, gives a user anything usable — the API alone does nothing without the UI, and vice versa. The good split produces a sequence of genuinely shippable increments, each one delivering real (if incremental) value, which is the entire reason INVEST asks for "Valuable" and "Independent" in the first place.
Check your understanding
A quick comprehension check — not tracked, not graded, just for you.
1. According to Ron Jeffries, what does a user story card actually stand for?
2. What does the 'Negotiable' criterion in INVEST mean for a story?
3. Why do concrete acceptance criteria prevent disputes that a story's plain description alone doesn't?
4. Why is splitting 'build the login API' and 'build the login UI' into separate stories usually a bad split?
Agile & Project Management