--- id: ATS-PFM-ELG-002 scope: CAP-PFM-ELG-002 product_area: platform module: eligibility revision: 3 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-ELG-002-01 title: Enforce rule-reading authority level: api proves: - BR-CAP-PFM-ELG-002-01 preconditions: >- Readers, callers without read authority, a roleless person and an outside-customer user are available. steps: Request lists and rule details as each caller. expected: Authorized readers receive results and the remaining callers are rejected. negative: true data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a caller without platform.eligibility.read, 403 - TST-PFM-ELG-411 - >- react-console:acceptance/eligibility/playwright/journeys/definitions/ELIG-ACC-0058.spec.ts#ELIG-ACC-0058 - TST-PFM-ELG-103 provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a caller without platform.eligibility.read, 403 category: permission action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a caller without platform.eligibility.read, 403 assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a caller without platform.eligibility.read, 403 binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-002-02 title: Exclude portal administration level: api proves: - BR-CAP-PFM-ELG-002-02 preconditions: A member signs in through the portal. steps: Request definition and binding administration. expected: Each request fails because the caller context is incompatible. negative: true data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a portal caller every definitions route, as a context mismatch - TST-PFM-ELG-411 - >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a portal caller the bindings routes provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a portal caller every definitions route, as a context mismatch category: permission action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a portal caller every definitions route, as a context mismatch assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a portal caller every definitions route, as a context mismatch binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-002-03 title: Filter without wildcard interpretation level: api proves: - BR-CAP-PFM-ELG-002-03 preconditions: 'Two workspaces contain varied statuses, owners and conditions.' steps: Apply every filter and search using mixed case and a percent character. expected: >- Results remain local and key-ordered; matching is case-insensitive and the percent character is literal. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#lists the tenant’s definitions in key order, and none of another tenant’s - TST-PFM-ELG-439 - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#filters by status - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#filters by a condition type a draft or published version uses - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#matches the text in the name without regard to case - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#takes a percent sign in the text literally rather than as a wildcard - >- react-console:acceptance/eligibility/playwright/journeys/definitions/ELIG-ACC-0053.spec.ts#ELIG-ACC-0053 - TST-PFM-ELG-098 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#lists the tenant’s definitions in key order, and none of another tenant’s category: rule action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#lists the tenant’s definitions in key order, and none of another tenant’s assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#lists the tenant’s definitions in key order, and none of another tenant’s binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-002-04 title: Reject invalid search parameters level: api proves: - BR-CAP-PFM-ELG-002-04 preconditions: An eligibility reader is available. steps: Send 201 search characters and an unsupported status. expected: Each failure identifies the invalid parameter. negative: true data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a search text longer than a name can be, 400 - TST-PFM-ELG-411 - >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses an explorer filter outside the closed list, 400 - >- react-console:acceptance/eligibility/playwright/journeys/definitions/ELIG-ACC-0054.spec.ts#ELIG-ACC-0054 - TST-PFM-ELG-099 provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a search text longer than a name can be, 400 category: validation action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a search text longer than a name can be, 400 assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a search text longer than a name can be, 400 binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-002-05 title: Inspect grouped dependencies level: api proves: - BR-CAP-PFM-ELG-002-07 preconditions: 'A rule has two purpose groups, a lagging pin and two referencing rules.' steps: Open usage. expected: >- Purpose-ordered groups expose counts and binding details, and referencing rules include their usage. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#groups the bindings by consumer kind in kind order, each labelled from the registry and counted - TST-PFM-ELG-436 - >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#answers each binding with its consumer, mode, status, fail policy and pin - >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#answers each reference with its pin and the referencing definition’s own usage, in key order - >- react-console:acceptance/eligibility/playwright/journeys/governance/ELIG-ACC-0139.spec.ts#ELIG-ACC-0139 - TST-PFM-ELG-171 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#groups the bindings by consumer kind in kind order, each labelled from the registry and counted category: rule action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#groups the bindings by consumer kind in kind order, each labelled from the registry and counted assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#groups the bindings by consumer kind in kind order, each labelled from the registry and counted binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-002-06 title: Compare dependency counts level: api proves: - BR-CAP-PFM-ELG-002-08 preconditions: Other rules include the target through a publication and draft. steps: 'Read overview and explorer counts, then attempt archive.' expected: The same reference count appears in all three results. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#counts the draft reference as well as the published one in the definition’s overview - TST-PFM-ELG-439 - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#counts the same number in the explorer’s row - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#is the number the archive refusal names provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#counts the draft reference as well as the published one in the definition’s overview category: invariant action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#counts the draft reference as well as the published one in the definition’s overview assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#counts the draft reference as well as the published one in the definition’s overview binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-002-07 title: Conceal outside-workspace rules level: api proves: - BR-CAP-PFM-ELG-002-09 preconditions: A separate workspace owns the requested rule. steps: 'Read its detail, usage and comparison from the current workspace.' expected: All three requests return not found. negative: true data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#refuses a key the tenant does not have, 404 - TST-PFM-ELG-439 - >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#refuses a definition the tenant does not have, 404 - TST-PFM-ELG-436 - >- services-platform:modules/eligibility/tests/integration/services/governance/diff.integration.spec.js#refuses the definition in another tenant, which does not have it - TST-PFM-ELG-432 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#refuses a key the tenant does not have, 404 category: boundary action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#refuses a key the tenant does not have, 404 assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#refuses a key the tenant does not have, 404 binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-002-08 title: Expose optional catalogue entries level: browser proves: - BR-CAP-PFM-ELG-002-10 preconditions: 'Active, archived and private product rules exist.' steps: Open the configuration list and enable each visibility switch. expected: >- The relevant hidden entries appear only after their switch is enabled, with private product ownership shown. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- react-console:acceptance/eligibility/playwright/journeys/definitions/ELIG-ACC-0079.spec.ts#ELIG-ACC-0079 - TST-PFM-ELG-124 provenance: test source: >- react-console:acceptance/eligibility/playwright/journeys/definitions/ELIG-ACC-0079.spec.ts#ELIG-ACC-0079 category: edge action_evidence: provenance: test source: >- react-console:acceptance/eligibility/playwright/journeys/definitions/ELIG-ACC-0079.spec.ts#ELIG-ACC-0079 assertion_evidence: provenance: test source: >- react-console:acceptance/eligibility/playwright/journeys/definitions/ELIG-ACC-0079.spec.ts#ELIG-ACC-0079 binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-002-09 title: Discover a saved draft category: interaction level: api proves: - BR-CAP-PFM-ELG-001-06 - BR-CAP-PFM-ELG-002-06 exercises: - CAP-PFM-ELG-002 - CAP-PFM-ELG-001 preconditions: A rule author and a reader share a workspace. steps: >- Create a bare rule, save a draft that references a released rule, then inspect the list and detail. expected: >- The new rule is discoverable and its draft and reference counts agree with the saved expression. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/authoring.integration.spec.js#creates a definition without a draft when the request carries no expression; services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#answers the version it last published and its draft action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/authoring.integration.spec.js#creates a definition without a draft when the request carries no expression; services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#answers the version it last published and its draft assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/authoring.integration.spec.js#creates a definition without a draft when the request carries no expression; services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#answers the version it last published and its draft binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-002-10 title: Use dependency counts to decide archive readiness category: interaction level: api proves: - BR-CAP-PFM-ELG-002-08 - BR-CAP-PFM-ELG-005-03 exercises: - CAP-PFM-ELG-002 - CAP-PFM-ELG-005 preconditions: A rule has a following use and a live draft reference. steps: >- Read its overview and usage, attempt archive, remove the use and reference, then repeat the reads and archive. expected: The refusal counts agree with discovery; removing both dependencies permits archive. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#is the number the archive refusal names; services-platform:modules/eligibility/tests/integration/services/persistence/definitions.integration.spec.js#refuses while an active binding follows it, counting the binding, and leaves it active action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#is the number the archive refusal names; services-platform:modules/eligibility/tests/integration/services/persistence/definitions.integration.spec.js#refuses while an active binding follows it, counting the binding, and leaves it active assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/explorer.integration.spec.js#is the number the archive refusal names; services-platform:modules/eligibility/tests/integration/services/persistence/definitions.integration.spec.js#refuses while an active binding follows it, counting the binding, and leaves it active binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-002-11 title: Discover a newly connected consumer category: interaction level: api proves: - BR-CAP-PFM-ELG-002-07 - BR-CAP-PFM-ELG-007-09 exercises: - CAP-PFM-ELG-002 - CAP-PFM-ELG-007 preconditions: A published rule has no uses. steps: 'Connect a consumer, inspect usage, remove the use and inspect usage again.' expected: >- Usage identifies the consumer and its version choice while connected and removes that entry after deletion. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#groups the bindings by consumer kind in kind order, each labelled from the registry and counted; services-platform:modules/eligibility/tests/integration/services/persistence/bindings.integration.spec.js#takes the binding’s plans with it action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#groups the bindings by consumer kind in kind order, each labelled from the registry and counted; services-platform:modules/eligibility/tests/integration/services/persistence/bindings.integration.spec.js#takes the binding’s plans with it assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/governance/usage.integration.spec.js#groups the bindings by consumer kind in kind order, each labelled from the registry and counted; services-platform:modules/eligibility/tests/integration/services/persistence/bindings.integration.spec.js#takes the binding’s plans with it binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-002-12 title: Find retained history from a rule category: interaction level: api proves: - BR-CAP-PFM-ELG-002-01 - BR-CAP-PFM-ELG-009-06 exercises: - CAP-PFM-ELG-002 - CAP-PFM-ELG-009 preconditions: A rule has retained bound decisions and read authority is available. steps: >- Open the rule, request its newest decision page and inspect one decision; repeat in another workspace. expected: >- The rule reader sees the matching decision details locally and receives no history through the other workspace. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a caller without platform.eligibility.read, 403; services-platform:modules/eligibility/tests/e2e/eligibility-evaluate.e2e.spec.js#answers 404 for a decision the tenant does not have action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a caller without platform.eligibility.read, 403; services-platform:modules/eligibility/tests/e2e/eligibility-evaluate.e2e.spec.js#answers 404 for a decision the tenant does not have assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/e2e/eligibility-definitions.e2e.spec.js#refuses a caller without platform.eligibility.read, 403; services-platform:modules/eligibility/tests/e2e/eligibility-evaluate.e2e.spec.js#answers 404 for a decision the tenant does not have binding_scope: This sequence is proposed and has no executable proof binding. - title: Traverse exact explorer page boundaries category: boundary level: api proves: - BR-CAP-PFM-ELG-002-05 - BR-CAP-PFM-ELG-002-09 preconditions: A workspace contains 201 uniquely keyed rules and another contains a sentinel rule. steps: 'Request the default page, a page of 200, an excessive page and the remaining cursor page.' expected: >- The default contains 50 rules, the maximum contains 200, the excessive request is refused and traversal returns every local rule once. negative: true data_needs: 'Run-owned fixtures, separate caller contexts and a controlled clock where required.' bound_to: [] provenance: proposed source: 'services-platform:modules/eligibility/services/model/explorer.ts' id: ATS-PFM-ELG-002-13 action_evidence: provenance: proposed source: 'services-platform:modules/eligibility/services/model/explorer.ts' assertion_evidence: provenance: proposed source: 'services-platform:modules/eligibility/services/model/explorer.ts' binding_scope: This sequence is proposed and has no executable proof binding. evidence: - >- services-platform: docs/eligibility.md; docs/milestones/PLAT-M11-eligibility-rules.md and plans/PLAT-M11-plan.md; docs/proposals/eligibility/17-decision-register.md; aws/platform.service.ts (ELIGIBILITY_PERMISSIONS); modules/eligibility/aws/api/definitions.routes.ts (list, get, usage), eligibility-api-mapper.ts, services/model/explorer.ts, services/governance/usage.ts, services/persistence/dependencies.ts (liveReferencesOf), paging.ts, db/eligibility-dependencies.table.ts, db/row-level-security.ts; rule-level source and test references - >- react-console: components/configuration/resources/eligibility-rules.tsx, components/eligibility/list/**, components/eligibility/governance/usage-panel.tsx, lib/configuration/eligibility-rules.ts, lib/configuration/areas.ts (eligibility-rules); acceptance/eligibility/journeys/{definitions,governance,security}/*.json. related_coverage: - capability: CAP-PFM-ELG-001 scenario: ATS-PFM-ELG-002-09 - capability: CAP-PFM-ELG-005 scenario: ATS-PFM-ELG-002-10 - capability: CAP-PFM-ELG-007 scenario: ATS-PFM-ELG-002-11 - capability: CAP-PFM-ELG-009 scenario: ATS-PFM-ELG-002-12 coverage: rule: 'gap: FND-PFM-ELG-054' transition: 'gap: FND-PFM-ELG-054' validation: covered permission: 'gap: FND-PFM-ELG-054' edge: covered failure: 'gap: FND-PFM-ELG-054' boundary: covered concurrency: 'gap: FND-PFM-ELG-054' invariant: 'gap: FND-PFM-ELG-054' interaction: covered invariant_gaps: - invariant: INV-DOM-PFM-ELG-001-03 finding: FND-PFM-ELG-054 source: 'services-platform:modules/eligibility/lifecycle.ts:VERSION_TRANSITIONS' - invariant: INV-DOM-PFM-ELG-001-08 finding: FND-PFM-ELG-054 source: >- services-platform:modules/eligibility/db/eligibility-definitions.table.ts:eligibility_definitions_replaced_by_check transition_coverage: [] permission_coverage: - key: platform.eligibility.read finding: FND-PFM-ELG-054 reason: A capability-level authority scenario does not prove every operation protected by this key. coverage_notes: meaning: >- Covered means a detailed scenario exists; it does not mean the scenario ran or every executable assertion conforms. gaps: >- Explorer paging needs exact default and maximum page sizes, cursor traversal and concurrent dependency changes. The reporting promise has no executable dataset proof. --- # Locate rules and understand their dependencies: Capability Test Specification ## Coverage The scenarios check observable outcomes against the cited contracts. The coverage map retains partial proof and unresolved design boundaries as findings. | Required Rule | Scenarios | |---|---| | `BR-CAP-PFM-ELG-002-01` | `ATS-PFM-ELG-002-01`, `ATS-PFM-ELG-002-12` | | `BR-CAP-PFM-ELG-002-02` | `ATS-PFM-ELG-002-02` | | `BR-CAP-PFM-ELG-002-03` | `ATS-PFM-ELG-002-03` | | `BR-CAP-PFM-ELG-002-04` | `ATS-PFM-ELG-002-04` | | `BR-CAP-PFM-ELG-002-05` | `ATS-PFM-ELG-002-13` | | `BR-CAP-PFM-ELG-002-07` | `ATS-PFM-ELG-002-05`, `ATS-PFM-ELG-002-11` | | `BR-CAP-PFM-ELG-002-08` | `ATS-PFM-ELG-002-06`, `ATS-PFM-ELG-002-10` | | `BR-CAP-PFM-ELG-002-09` | `ATS-PFM-ELG-002-07`, `ATS-PFM-ELG-002-13` | ## Interactions With Related Capabilities Discover a saved draft. Create a bare rule, save a draft that references a released rule, then inspect the list and detail. Use dependency counts to decide archive readiness. Read its overview and usage, attempt archive, remove the use and reference, then repeat the reads and archive. Discover a newly connected consumer. Connect a consumer, inspect usage, remove the use and inspect usage again. Find retained history from a rule. Open the rule, request its newest decision page and inspect one decision; repeat in another workspace.