A paper on paper is protected by a locked cupboard and an invigilator. An online paper needs its own version of both, and they have to be decided before the day, not during it.
The paper stays private until it opens
Drafts should be readable only by the people writing them, and a reviewer should see a paper because it was submitted for review, not because their role happens to unlock every file. When the sitting opens, candidates receive the questions and nothing else: no answer key travels with them.
The window is clear to everyone
Say when the paper opens, how long a candidate has, and what happens to someone who arrives late. A late starter loses the time they missed, exactly as in a hall, and everyone should know that before the day.
A clock every candidate can see is worth more than any rule written in a policy.
Results are released, not leaked
Marking can finish days before the school is ready to tell families. A result should reach a student only when the school chooses to release it, and a correction after release should be visible as a correction, not a silent edit.