---
id: ATS-CRM-ACT-019
scope: CAP-CRM-ACT-019
product_area: crm
module: activities-tasks
revision: 3
status: proposed
approved_by: null
approved_at: null
source_sha:
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  rhythm-v2-docs: 18a49edf30ee6bda18b159b65a2b91e093ea713d
scenarios:
- id: ATS-CRM-ACT-019-01
  title: Enforce workspace boundaries on records and local references
  level: api
  proves:
  - BR-CAP-CRM-ACT-019-01
  - BR-CAP-CRM-ACT-019-02
  preconditions: Two workspaces hold activities, tasks and related records.
  steps: Read and mutate foreign records and attempt foreign contact links.
  expected: Foreign data appears absent, writes and links fail, and original records remain unchanged.
  negative: true
  data_needs: Each run creates and isolates the records it needs.
  bound_to:
  - services-crm:modules/activities/tests/integration/db/activities.table.integration.spec.js#shows the
    tenant none of the other tenant’s activities, links or types, with no predicate of its own
  - services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#answers tenant B 404 for tenant A’s
    activity
  - 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses tenant B a link to tenant
    A’s contact: 400'
  - services-crm:modules/tasks/tests/integration/services/persistence/tasks.integration.spec.js#reads
    as absent to this tenant, rather than as a task it may not have
  - services-crm:modules/tasks/tests/integration/services/persistence/tasks.integration.spec.js#is left
    exactly as the other tenant had it, every refusal above having written nothing
  - react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0718.spec.ts#CRM-ACC-0718
  - TST-CRM-ACT-003
  - TST-CRM-ACT-002
  - TST-CRM-ACT-025
  - TST-CRM-ACT-062
  provenance: test
  source: services-crm:modules/activities/tests/integration/db/activities.table.integration.spec.js#shows
    the tenant none of the other tenant’s activities, links or types, with no predicate of its own
  category: invariant
  binding_scope: Each registered suite contributes the assertions named by the retained file bindings;
    a compound scenario can require several suites. Conformance remains unverified.
- id: ATS-CRM-ACT-019-02
  title: Reject a mismatched signed context
  level: api
  proves:
  - BR-CAP-CRM-ACT-019-03
  preconditions: A context names one workspace.
  steps: Use it against another workspace’s activity and task addresses.
  expected: The boundary returns Forbidden.
  negative: true
  data_needs: Each run creates and isolates the records it needs.
  bound_to:
  - 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a context for tenant B on
    tenant A’s path: 403'
  - services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 for a tenant the context does not
    cover
  - TST-CRM-ACT-002
  - TST-CRM-ACT-015
  provenance: test
  source: 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a context for tenant
    B on tenant A’s path: 403'
  category: permission
  binding_scope: Each registered suite contributes the assertions named by the retained file bindings;
    a compound scenario can require several suites. Conformance remains unverified.
- id: ATS-CRM-ACT-019-03
  title: Apply activity permissions to each operation
  level: api
  proves:
  - BR-CAP-CRM-ACT-019-04
  preconditions: Callers have read-only, user and missing-read authority.
  steps: Exercise activity creation, reads, edits and deletion.
  expected: Each operation requires its declared activity permission.
  negative: true
  data_needs: Each run creates and isolates the records it needs.
  bound_to:
  - 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller who
    may only read activities: 403'
  - 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a read to a caller without
    crm.activities.read: 403'
  - 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a replace to a caller without
    crm.activities.update: 403'
  - 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a patch to a caller without
    crm.activities.update: 403'
  - 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a delete to a caller without
    crm.activities.delete: 403'
  - react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0715.spec.ts#CRM-ACC-0715
  - TST-CRM-ACT-002
  - TST-CRM-ACT-059
  provenance: test
  source: 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller
    who may only read activities: 403'
  category: permission
  binding_scope: Each registered suite contributes the assertions named by the retained file bindings;
    a compound scenario can require several suites. Conformance remains unverified.
- id: ATS-CRM-ACT-019-04
  title: Permit task reads without granting task changes
  level: api
  proves:
  - BR-CAP-CRM-ACT-019-05
  preconditions: A caller holds task read only.
  steps: Read a task, edit it and claim it.
  expected: Reading succeeds and mutation requests are forbidden.
  negative: true
  data_needs: Each run creates and isolates the records it needs.
  bound_to:
  - services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#lets a caller who may only read tasks read
    one
  - services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read tasks
  - services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read tasks
    claiming one
  - react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0716.spec.ts#CRM-ACC-0716
  - TST-CRM-ACT-015
  - TST-CRM-ACT-060
  provenance: test
  source: services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#lets a caller who may only read tasks
    read one
  category: permission
  binding_scope: Each registered suite contributes the assertions named by the retained file bindings;
    a compound scenario can require several suites. Conformance remains unverified.
- id: ATS-CRM-ACT-019-05
  title: Reserve configuration maintenance for administrators
  level: api
  proves:
  - BR-CAP-CRM-ACT-019-06
  preconditions: Callers may inspect activity and task configuration only.
  steps: Create an activity type and reorder task types.
  expected: Both maintenance requests are forbidden.
  negative: true
  data_needs: Each run creates and isolates the records it needs.
  bound_to:
  - 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a type’s create to a caller
    who may only read types: 403'
  - services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read task
    types
  - TST-CRM-ACT-002
  - TST-CRM-ACT-015
  provenance: test
  source: 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a type’s create to
    a caller who may only read types: 403'
  category: permission
  binding_scope: Each registered suite contributes the assertions named by the retained file bindings;
    a compound scenario can require several suites. Conformance remains unverified.
- id: ATS-CRM-ACT-019-06
  title: Demonstrate a full activity lock’s missing release path
  level: api
  proves:
  - BR-CAP-CRM-ACT-019-08
  preconditions: An activity permits an ordinary edit.
  steps: Save a full lock and attempt to clear it through editing.
  expected: Setting succeeds and clearing fails; the recorded audited lock operations remain unimplemented.
  negative: true
  data_needs: Each run creates and isolates the records it needs.
  bound_to:
  - react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0699.spec.ts#CRM-ACC-0699
  - TST-CRM-ACT-043
  provenance: test
  source: react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0699.spec.ts#CRM-ACC-0699
  category: failure
  binding_scope: Each registered suite contributes the assertions named by the retained file bindings;
    a compound scenario can require several suites. Conformance remains unverified.
- id: ATS-CRM-ACT-019-07
  title: Access restrictions span logging work and configuration
  category: interaction
  level: api
  proves:
  - BR-CAP-CRM-ACT-019-04
  - BR-CAP-CRM-ACT-019-05
  - BR-CAP-CRM-ACT-019-06
  preconditions: Readers, contributors and administrators exist in two workspaces.
  steps: Exercise reads, activity correction, task deletion and both classification catalogs using each
    persona; retry with foreign record references.
  expected: Each operation follows its own declared authority; forbidden and foreign requests leave all
    records and configuration unchanged.
  negative: false
  data_needs: Run-owned records in an isolated workspace; fixed clock for calendar checks.
  bound_to: []
  provenance: proposed
  source: 'services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller
    who may only read activities: 403; services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers
    403 to a caller who may only read tasks claiming one; services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses
    a type’s create to a caller who may only read types: 403'
  exercises:
  - CAP-CRM-ACT-019
  - CAP-CRM-ACT-003
  - CAP-CRM-ACT-010
  - CAP-CRM-ACT-008
  - CAP-CRM-ACT-016
  related:
  - CAP-CRM-ACT-003
  - CAP-CRM-ACT-010
  - CAP-CRM-ACT-008
  - CAP-CRM-ACT-016
- id: ATS-CRM-ACT-019-08
  title: Reject unauthenticated entry before any write
  category: permission
  level: api
  proves:
  - BR-CAP-CRM-ACT-019-07
  preconditions: No signed execution context is supplied.
  steps: Invoke an activity route without a context.
  expected: The route returns Unauthenticated and retains no write.
  negative: true
  data_needs: Run-owned records in an isolated workspace; fixed clock for calendar checks.
  bound_to:
  - services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#answers 401 without a context
  - TST-CRM-ACT-002
  provenance: test
  source: services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#answers 401 without a context
  binding_scope: Each registered suite contributes the assertions named by the retained file bindings;
    a compound scenario can require several suites. Conformance remains unverified.
evidence:
- 'services-crm at a8d1364f1dd44b723bb5f9acba12f983e9ec8d69: scenario sources, executable assertions and
  local dependency boundaries are inspected.'
- 'react-console at baf6dae382d6f41dce976c7f848667ccc37e076f: scoped component tests and browser journey
  assertions are inspected.'
coverage:
  rule: 'gap: FND-CRM-ACT-065'
  transition: 'gap: FND-CRM-ACT-065'
  validation: 'gap: FND-CRM-ACT-065'
  permission: covered
  edge: 'gap: FND-CRM-ACT-065'
  failure: covered
  boundary: 'gap: FND-CRM-ACT-065'
  concurrency: 'gap: FND-CRM-ACT-065'
  invariant: covered
  interaction: covered
coverage_obligations:
  finding: FND-CRM-ACT-065
  unproved_rules:
  - BR-CAP-CRM-ACT-019-10
  permission_matrix:
    keys:
    - crm.activities.read
    - crm.activities.create
    - crm.activities.update
    - crm.activities.delete
    - crm.activities.bulk
    - crm.activities.query
    - crm.activities.history
    - crm.tasks.read
    - crm.tasks.create
    - crm.tasks.update
    - crm.tasks.delete
    - crm.tasks.bulk
    - crm.tasks.query
    remaining: Complete allow/refuse combinations, including each console guard and each API operation.
  execution_note: Covered means a scenario is specified; it does not mean that scenario has executed or
    every variant has an executable binding.
related_coverage:
- capability: CAP-CRM-ACT-003
  scenarios:
  - ATS-CRM-ACT-019-07
  finding: FND-CRM-ACT-065
- capability: CAP-CRM-ACT-010
  scenarios:
  - ATS-CRM-ACT-019-07
  finding: FND-CRM-ACT-065
- capability: CAP-CRM-ACT-008
  scenarios:
  - ATS-CRM-ACT-019-07
  finding: FND-CRM-ACT-065
- capability: CAP-CRM-ACT-016
  scenarios:
  - ATS-CRM-ACT-019-07
  finding: FND-CRM-ACT-065
permission_coverage:
- key: crm.activities.read
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.activities.create
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.activities.update
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.activities.delete
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.activities.bulk
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.activities.query
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.activities.history
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.tasks.read
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.tasks.create
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.tasks.update
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.tasks.delete
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.tasks.bulk
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
- key: crm.tasks.query
  finding: FND-CRM-ACT-065
  note: The finding covers unproved operation and surface combinations; a permission-category scenario
    is not a complete permission matrix.
---

# Apply workspace access and maintenance permissions: Capability Test Specification

## Coverage

Category coverage counts specified proof. Unbound cases remain proposed; registered assertions do not establish a passing run.

| Rule | Proof Scenario Or Finding |
|---|---|
| `BR-CAP-CRM-ACT-019-01` | `ATS-CRM-ACT-019-01` |
| `BR-CAP-CRM-ACT-019-02` | `ATS-CRM-ACT-019-01` |
| `BR-CAP-CRM-ACT-019-03` | `ATS-CRM-ACT-019-02` |
| `BR-CAP-CRM-ACT-019-04` | `ATS-CRM-ACT-019-03`, `ATS-CRM-ACT-019-07` |
| `BR-CAP-CRM-ACT-019-05` | `ATS-CRM-ACT-019-04`, `ATS-CRM-ACT-019-07` |
| `BR-CAP-CRM-ACT-019-06` | `ATS-CRM-ACT-019-05`, `ATS-CRM-ACT-019-07` |
| `BR-CAP-CRM-ACT-019-07` | `ATS-CRM-ACT-019-08` |
| `BR-CAP-CRM-ACT-019-08` | `ATS-CRM-ACT-019-06` |
| `BR-CAP-CRM-ACT-019-10` | `FND-CRM-ACT-065` |

## Interactions With Related Capabilities

Readers, contributors and administrators exist in two workspaces. Exercise reads, activity correction, task deletion and both classification catalogs using each persona; retry with foreign record references.

The interaction scenario names the capabilities and rules it exercises. The coverage finding retains incomplete permission combinations and failure variants.