---
id: TST-ACC-BAT-059
title: Batch API batches security
kind: api-lifecycle
product_area: accounting
module: batches
revision: 1
status: draft
product_intent: proposed
implementation_evidence: observed
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
repository: services-accounting
files:
  - modules/batches/tests/e2e/batches-security.e2e.spec.js
implements:
  - ATS-ACC-BAT-009-11
  - ATS-ACC-BAT-011-09
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 5
isolation: >-
  The suite owns its test workspace or fixed integration fixtures in the
  prepared local database.
assertion_sources:
  - scenario: ATS-ACC-BAT-009-11
    provenance: test
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#lists
      the recurring batches
  - scenario: ATS-ACC-BAT-009-11
    provenance: test
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#is
      refused the create 403 permission_missing
  - scenario: ATS-ACC-BAT-009-11
    provenance: test
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#is
      refused the replacement 403 permission_missing
  - scenario: ATS-ACC-BAT-009-11
    provenance: test
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#is
      refused the delete 403 permission_missing
  - scenario: ATS-ACC-BAT-009-11
    provenance: test
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#is
      refused the recurring batch list 403 app_not_permitted, however broad its
      other grant
  - scenario: ATS-ACC-BAT-011-09
    provenance: test
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#reads
      a unit’s batch assignment settings
  - scenario: ATS-ACC-BAT-011-09
    provenance: test
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#is
      refused the save 403 permission_missing
  - scenario: ATS-ACC-BAT-011-09
    provenance: test
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#is
      refused the delete 403 permission_missing
evidence:
  - provenance: observed
    source: 'services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js'
    note: >-
      The executable file is inspected at the pinned revision; duration is an
      unmeasured planning estimate.
  - provenance: documented
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#suite
      header
    note: >-
      Real: the composed handler (the dispatcher, the tenant access gate, the
      application access and licence steps), the routes,
  - provenance: documented
    source: >-
      services-accounting:modules/batches/tests/e2e/batches-security.e2e.spec.js#suite
      header
    note: >-
      PostgreSQL (row-level security). Doubled: the signing key pair, which is
      the run's own. Never doubled: the dispatcher, the
unbound_scope: null
---

# Batch API batches security

## Verification Boundary

This suite invokes the composed Accounting dispatcher locally against the prepared database. It exercises request mapping, declared authorization checks and the asserted persistence results.

## What This Suite Proves

Accounting application access and recurring and routing grants distinguish permitted reads from refused writes. The assertion anchors identify the supported portions of the bound scenarios.

## What It Does Not Prove

Local assertions do not establish deployment configuration, remote delivery guarantees, or unasserted lifecycle and concurrency paths.

## Real Dependencies and Test Doubles

PostgreSQL and the exercised persistence or accounting functions are real. Controlled clocks, imported test fixtures and any suite-specific doubles delimit the asserted behavior.

## Must Not Be Doubled

The database constraints, transaction boundaries and exercised accounting functions must remain real when qualifying the asserted persistence or generation behavior.