Delivery
Accessibility is an authorization requirement
Section 508 and WCAG AA are not a late polish pass. They belong in the same gate as security and operations.
WF-INS-2026-01
Public services do not ship because a visual design is complete. They ship when they can be used, operated, and authorized.
Treat accessibility the same way you treat a failing test in CI. If a view cannot be completed from the keyboard, if names and roles are missing, or if contrast falls below 4.5:1, the build does not proceed. That rule is easier to defend in an ATO conversation than a promise to “fix 508 after launch.”
The work is not a overlay or a plugin. It is the interface: structure, focus order, text alternatives, and error recovery. Assistive-tech testing belongs beside unit tests, not in a separate report that arrives after the contract period.
When those checks are in the publishing path, editorial teams stop introducing regressions that security reviewers then have to explain. Authorization becomes a record of controls that already run, not a scramble for evidence.