---
id: TST-CRM-REG-067
title: Regional route permission declarations
kind: unit
product_area: crm
module: regions
revision: 1
status: draft
source_sha:
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
repository: services-crm
files:
  - tests/unit/regions-authorization.spec.ts
implements:
  - ATS-CRM-REG-002-03
  - ATS-CRM-REG-007-03
  - ATS-CRM-REG-011-01
  - ATS-CRM-REG-013-01
  - ATS-CRM-REG-014-01
  - ATS-CRM-REG-014-02
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 2
isolation: In-memory values and test-owned component state.
evidence:
  - 'services-crm:tests/unit/regions-authorization.spec.ts'
assertions:
  - scenario: ATS-CRM-REG-002-03
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.delete to delete a
      region
  - scenario: ATS-CRM-REG-007-03
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to preview the
      region an address would be assigned, because it writes nothing
  - scenario: ATS-CRM-REG-011-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.recalculate to start a
      recalculation
  - scenario: ATS-CRM-REG-011-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#publishes crm.regions.recalculate in the
      catalog, at tier admin
  - scenario: ATS-CRM-REG-013-01
    source: 'services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list regions'
  - scenario: ATS-CRM-REG-013-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.create to create a
      region
  - scenario: ATS-CRM-REG-013-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to replace a
      region
  - scenario: ATS-CRM-REG-013-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.delete to delete a
      region
  - scenario: ATS-CRM-REG-013-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to save the
      assignment settings
  - scenario: ATS-CRM-REG-013-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to reorder the
      assignment rules
  - scenario: ATS-CRM-REG-013-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list and read
      recalculations
  - scenario: ATS-CRM-REG-013-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#serves every regions route to console users
      only
  - scenario: ATS-CRM-REG-014-01
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#the data jobs of regions, which are the
      configuration data-job routes under /regions › requires crm.regions.bulk AND crm.regions.update of
      every one of them, which the read key alone does not give
  - scenario: ATS-CRM-REG-014-02
    source: >-
      services-crm:tests/unit/regions-authorization.spec.ts#the data jobs of regions, which are the
      configuration data-job routes under /regions › publishes the twelve routes a job of regions has:
      the submission, the list, the status, the lookup by source key, the two pages, the apply, the four
      control actions and the revalidation of conflicts
binding_scope: >-
  Exact assertion anchors identify the contribution of this file. Scenario-level bindings may compose
  several files; registration does not assert that every file alone executes every scenario step.
---

# Regional route permission declarations

## Verification Boundary

The suite exercises regional calculations, declarations or console components with test inputs. Its assertions do not establish deployed service behavior.

## What This Suite Proves

The linked source assertions contribute checks for delete authority is separate from edit authority; preview is read-authorized work; start authority uses the admin-tier key; route declarations identify the required authority; bulk work requires both regional keys; the hosted import surface contains twelve operations. A scenario spanning several files relies on those assertions together; this file supplies only its named checks.

## What It Does Not Prove

The register establishes neither a current passing run nor verified conformance. Unbound scenarios, broader feature chains and the delegated infrastructure beyond this execution boundary remain unproved.

## Real Dependencies and Test Doubles

Test inputs, execution contexts, request clients or component dependencies are supplied by the suite. Database persistence and deployed transport are outside this boundary.

## Must Not Be Doubled

The calculation, permission declaration or console behavior under assertion must remain the real implementation.