AI generates acceptance criteria that cover the happy path and the most common failure modes reliably. It misses domain-specific edge cases that require business context the AI doesn't have, regulatory constraints, specific integrations, institutional quirks. This guide shows 10 AI-generated criteria across five feature types, with the specific PM edits that made each one testable by a QA engineer without clarification.
How AI generates acceptance criteria
Scriptonia generates acceptance criteria from user stories in the PRD. For each story, it applies a structured reasoning process: identify the success state, identify the common failure states, identify the validation path, and write each as a Given/When/Then statement. The generation is thorough on structure and coverage; it is weaker on domain-specific constraints that require knowledge outside the input.
10 real examples with PM edits
Feature type 1: Authentication, password reset
User story: As a user who forgot their password, I want to reset it from the login screen so that I can access my account without contacting support.
AI generated:
Given a user submits a valid email on the reset page, when they submit the form, then they receive a reset email within 60 seconds.
PM edit (added specificity):
Given a user submits a valid email on the reset page, when they submit the form, then they receive a reset email within 60 seconds and the email contains a single-use link that expires after 15 minutes.
Why the edit mattered: The AI omitted the expiry and single-use requirements, both security decisions that engineering needs to know before building.
Feature type 1: Authentication, second example
AI generated:
Given a user enters an email not in the system, when they submit the reset form, then they see an error message indicating the email was not found.
PM edit (changed the behavior):
Given a user enters an email not in the system, when they submit the reset form, then they see the same generic confirmation message as a valid email ("If this email is registered, you'll receive a reset link") with no indication that the email was not found (prevents account enumeration).
Why the edit mattered: The AI's default behavior exposed a security vulnerability. The correct behavior (same message for valid and invalid emails) is a security best practice the AI didn't apply by default.
Feature type 2: E-commerce checkout
AI generated:
Given a user completes checkout, when payment is processed successfully, then they are shown an order confirmation page with their order details.