A portal accepts a document, but staff cannot tell which version is current or who may open it. File handling needs a lifecycle as part of the application design.
Define the purpose and owner
Decide which file types and sizes are appropriate, which record the file belongs to and who can access it. Sensitive documents should not become publicly reachable simply because their links are hard to guess.
Give the user a clear upload result and a way to recover from a failed attempt. A progress indicator should not claim the file is accepted before the server confirms it.
Handle replacement deliberately
Choose whether a new file replaces an earlier one, creates a version or requires review. Staff should be able to identify the approved version and understand what remains available.
Test interrupted uploads, unsupported files, duplicate names and unauthorized downloads. Include the actual phone or field conditions where the feature will be used.
Retention, scanning and access requirements depend on the information and business context. Bring those needs to the project brief so the implementation can be scoped appropriately rather than treating files as an unstructured folder added at the end.
Check how the file appears after a related record is archived. Staff should understand whether the file remains available and which access rule continues to protect it.