---
id: TST-ACC-REC-026
title: Payout and reconciliation list access
kind: api-lifecycle
product_area: accounting
module: reconciliation
revision: 1
status: draft
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
repository: services-accounting
files:
  - modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js
implements:
  - ATS-ACC-REC-004-01
  - ATS-ACC-REC-004-06
  - ATS-ACC-REC-019-03
  - ATS-ACC-REC-019-04
  - ATS-ACC-REC-020-03
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 5
isolation: Suite-owned workspace fixtures and deterministic records removed by suite cleanup.
evidence:
  - 'services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js'
  - >-
    Declared test doubles: Doubled: the signing key pair, which is the run's own. Never doubled: the
    dispatcher, the route table, the verification, the evaluation or the persistence services. Every call acts
    in tenants of the spec's own (`testId`), registered in the local `platform.tenants` stand-in and removed
    in `after`. proves_controls: [TC-IAM-001, TC-AZ-002, TC-TEN-002, TC-PI-001]
bindings:
  - scenario: ATS-ACC-REC-004-01
    assertions:
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#answers 200 with
        the tenant’s payouts, newest accounting date first
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#pages by the
        cursor it answers, the last page answering none
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses a page
        larger than 200 with 400
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses a cursor
        it did not answer with 400
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses a date
        that is not YYYY-MM-DD with 400
  - scenario: ATS-ACC-REC-004-06
    assertions:
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#shows none of
        tenant A’s payouts in tenant B
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses the
        payout list without accounting.payouts.read with 403
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses a
        principal denied accounting.application.access with 403
  - scenario: ATS-ACC-REC-019-03
    assertions:
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#answers 200 with
        the tenant’s batches and the payouts each explains
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses a state
        outside the vocabulary with 400
  - scenario: ATS-ACC-REC-019-04
    assertions:
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses the
        batch list without accounting.reconciliation-batches.read with 403
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#shows none of
        tenant A’s batches in tenant B
  - scenario: ATS-ACC-REC-020-03
    assertions:
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses a
        request without a security context with 401
      - >-
        services-accounting:modules/reconciliation/tests/e2e/reconciliation-lists.e2e.spec.js#refuses a
        principal denied accounting.application.access with 403
---

# Payout and reconciliation list access

## Verification Boundary

This suite dispatches Accounting routes locally with enforcing security over a real test database. Its route responses and retained records form the verification boundary.

## What This Suite Proves

The executable assertions identified in the binding records supply the registered scenario observations. When a scenario names several suites, this suite supplies its listed assertions and does not independently establish every clause.

## What It Does Not Prove

Deployed infrastructure, live console behavior and shared scheduling delivery are outside this local boundary.

## Real Dependencies and Test Doubles

PostgreSQL, migrations and the exercised production code are real. Fixtures supply the financial world and caller context; deterministic setup and owner-side inspection do not replace database enforcement.

## Must Not Be Doubled

The exercised database constraints, transactional services and route enforcement remain real. Replacing them would remove the boundary this suite registers.