AI Prompt to Generate Test Cases from a User Story

Sample input: login feature

Fictional example written for this guide.

User story:
As a registered user, I want to log in with my email and password so that I can access my account dashboard.

Acceptance criteria:
AC1. A valid email and password redirects the user to /dashboard.
AC2. An invalid password shows "Email or password is incorrect" without revealing which field was wrong.
AC3. After 5 consecutive failed attempts the account is locked for 15 minutes.
AC4. The password field masks input and offers a show/hide toggle.

Sample AI output (illustrative, not executed)

Sample output only — this shows the shape of a good answer. It has not been run, executed, or verified against a real system.

Open questions
- Is the email match case-insensitive?
- Does a successful login reset the failed-attempt counter?
- Is the lockout message different from the generic error?

Positive
| ID | Title | AC | Steps | Expected | Priority |
| TC-01 | Login with valid credentials | AC1 | 1. Open /login 2. Enter valid email + password 3. Click Log in | Redirected to /dashboard | High |
| TC-02 | Toggle password visibility | AC4 | 1. Type password 2. Click show icon | Password shown as plain text; click again re-masks | Medium |

Negative
| TC-03 | Wrong password | AC2 | Enter valid email + wrong password | Generic error shown; field not identified | High |
| TC-04 | Unregistered email | AC2 | Enter unknown email | Same generic error as TC-03 | High |

Boundary / Edge
| TC-05 | 5th failed attempt locks account | AC3 | Fail login 5 times | Account locked; login blocked for 15 min | High |
| TC-06 | Login after lockout expires | AC3 | Wait 15 min after lock, log in correctly | ASSUMPTION: login succeeds | Medium |

Traceability: AC1 → TC-01 | AC2 → TC-03, TC-04 | AC3 → TC-05, TC-06 | AC4 → TC-02

Coverage checklist before you accept the output

Tick each item against the generated cases. Anything missing is a gap to add manually.

• Every acceptance criterion maps to at least one test case
• Happy path, invalid input, and empty input are all covered
• Boundaries are tested on both sides (e.g. 4th vs 5th failed attempt)
• Error messages are checked for exact wording and for not leaking data
• Session behaviour: refresh, back button, multiple tabs, logout
• Accessibility: keyboard-only login, screen-reader labels, focus on errors
• Cross-browser or device needs are noted if the story mentions them
• Assumptions are flagged and sent to the product owner, not silently kept

How to get better results

• Paste acceptance criteria verbatim — paraphrasing loses edge conditions.
• Add user roles (admin, guest) if they exist, or the AI will assume one role.
• Ask a follow-up: “Which risks are still untested?” to surface missing coverage.
• Run the prompt once per story; very long inputs produce shallow cases.