--- id: JNY-ACC-REC-006 title: Assign separate preparation and approval responsibilities feature: FEAT-ACC-REC-07 product_area: accounting module: reconciliation revision: 2 status: draft product_intent: confirmed implementation_evidence: partially-observed supersedes: - react-console acceptance journey ACT-ACC-0599 - react-console acceptance journey ACT-ACC-0608 - react-console acceptance journey ACT-ACC-0609 - react-console acceptance journey ACT-ACC-0610 - react-console acceptance journey ACT-ACC-0624 - react-console acceptance journey ACT-ACC-0628 - react-console acceptance journey ACT-ACC-0629 source_sha: services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f actor: ACT-ACC-019 goal: >- Use role policies and record controls to distinguish ordinary financial preparation from sensitive decisions. capabilities: - CAP-ACC-REC-001 - CAP-ACC-REC-004 - CAP-ACC-REC-011 - CAP-ACC-REC-020 screens: - '/console/{tenantId}/accounting/reconciliation' steps: - 'n': 1 surface: Platform security roles action: Assign preparer and approver policies to separate people and Accounting access alone to another. capability: CAP-ACC-REC-020 expected: >- Preparation supplies thirteen keys including application access, and approval adds four sensitive grants. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0608.spec.ts#ACT-ACC-0608 - 'n': 2 surface: listPayouts action: Attempt payout inspection with application access alone. capability: CAP-ACC-REC-020 expected: Record read authorization fails. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0608.spec.ts#ACT-ACC-0608 - 'n': 3 surface: getPayout action: Inspect payout and explanation records using a read-only role. capability: CAP-ACC-REC-004 expected: Inspection offers no write action and write attempts are forbidden. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0608.spec.ts#ACT-ACC-0608 - 'n': 4 surface: createPayout action: Prepare a deposit in another business unit. capability: CAP-ACC-REC-001 expected: Workspace grants allow preparation there without granting sensitive approvals. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0608.spec.ts#ACT-ACC-0608 - 'n': 5 surface: finalizeReconciliationBatch action: Approve the preparer’s explanation using the separate approver. capability: CAP-ACC-REC-011 expected: Eligible independent finalization succeeds. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0608.spec.ts#ACT-ACC-0608 - 'n': 6 surface: createPayout action: Retry keyed money requests and use the same key text as another person. capability: CAP-ACC-REC-020 expected: Original calls replay while a colleague’s key is scoped as a separate request. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0609.spec.ts#ACT-ACC-0609 alternates: - from_step: 5 condition: The workspace represents the second-person requirement as disabled. path: Finalize as the preparer with the waiver retained. outcome: Current product administration cannot set that waiver. provenance: unknown source: FND-ACC-REC-004 failures: - from_step: 5 condition: The intended approver previously claimed money in the draft. path: Reject finalization under the preparation guard. outcome: Another eligible approver must complete the decision. provenance: test source: >- services-accounting:modules/reconciliation/tests/integration/services/batch-lifecycle/finalize-batch.integration.spec.js#refuses a person who claimed items in it rules_in_play: - BR-CAP-ACC-REC-020-01 - BR-CAP-ACC-REC-020-02 - BR-CAP-ACC-REC-020-03 - BR-CAP-ACC-REC-020-04 - BR-CAP-ACC-REC-011-03 - BR-CAP-ACC-REC-004-06 assertions: - id: AS-JNY-ACC-REC-006-01 statement: Preparation policy grants ordinary work and approval policy adds the four sensitive decisions. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0608.spec.ts#ACT-ACC-0608 - id: AS-JNY-ACC-REC-006-02 statement: Keyed financial requests replay unchanged bodies and refuse changed requests. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0609.spec.ts#ACT-ACC-0609 - id: AS-JNY-ACC-REC-006-03 statement: Permission grants cover the workspace without unit-specific restrictions. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0608.spec.ts#ACT-ACC-0608 e2e_policy: required e2e_reason: >- Browser coverage is needed to establish the staff workflow across screens; separate API evidence supports the financial and permission decisions. evidence: - >- Journey verification uses the pinned command, refusal and assertion sources listed below. Mock evidence establishes only the command behavior described in its assertion. - >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0608.spec.ts#ACT-ACC-0608 - >- react-console:acceptance/accounting/playwright/journeys/reconciliation-close/ACT-ACC-0609.spec.ts#ACT-ACC-0609 - FND-ACC-REC-004 - >- services-accounting:modules/reconciliation/tests/integration/services/batch-lifecycle/finalize-batch.integration.spec.js#refuses a person who claimed items in it proved_by: [] --- # Assign separate preparation and approval responsibilities ## Story A controller assigns preparation and approval responsibilities through separate role policies. Callers exercise their grants across the workspace, while record reads and independent approval remain distinct. Keyed retries demonstrate how committed decisions stay stable without treating another person’s key as the original request.