Plan a scoped security check for a password-reset change.

A fictional staging application has authorized test accounts A and B and a reserved nonexistent test address. Its password-reset request endpoint returns the same HTTP 202 status and generic message for existing and nonexistent addresses. A reset token is bound to one account, expires at an age of exactly 20 minutes, and can succeed only once. A successful reset invalidates all existing sessions for that account but must not affect other accounts. QA can access a fake mailbox, a controlled test clock and a read-only session inspector. Test accounts and synthetic records are the only permitted targets. Keep requests below 15 per minute; load testing, real employee addresses and production systems are outside this engagement. No performance or response-time equivalence requirement is supplied.