--- id: ATS-PFM-LLM-011 scope: CAP-PFM-LLM-011 product_area: platform module: llm revision: 2 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-LLM-011-01 title: Customer administrators cannot use the HQ overview level: api proves: - BR-CAP-PFM-LLM-011-01 preconditions: A customer administrator has authority in their own organization. steps: Request the HQ AI account view. expected: Access is denied. negative: true data_needs: Fixtures representing a customer administrator has authority in their own organization. bound_to: - TST-PFM-LLM-009 provenance: test source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator a tenant’s usage even in their own tenant category: permission test_sources: - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator a tenant’s usage even in their own tenant - id: ATS-PFM-LLM-011-02 title: Foreign and absent records are not found level: api proves: - BR-CAP-PFM-LLM-011-02 preconditions: 'Two organizations hold requests and executions, with an additional nonexistent organization reference.' steps: Read foreign records under the first organization and request the missing organization. expected: Each returns not found within the appropriate organization boundary. negative: true data_needs: >- Fixtures representing two organizations hold requests and executions, with an additional nonexistent organization reference. bound_to: - TST-PFM-LLM-009 - TST-PFM-LLM-050 provenance: test source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers 404 for a tenant that does not exist category: boundary test_sources: - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers 404 for a tenant that does not exist - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers 404 for a request of another tenant, the tenant policy binding the read - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers 404 for an execution of another tenant and for one that does not exist - >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#refuses a tenant that does not exist as not found, before any usage is read - id: ATS-PFM-LLM-011-03 title: Overview sections fail independently level: api proves: - BR-CAP-PFM-LLM-011-03 - INV-DOM-PFM-LLM-004-07 preconditions: 'One organization is warned, another stopped, and a report subsection is unreadable.' steps: Read each overview. expected: >- Available sections retain correct state and figures while unavailable sections disclose their own failure. negative: false data_needs: >- Fixtures representing one organization is warned, another stopped, and a report subsection is unreadable. bound_to: - TST-PFM-LLM-050 provenance: test source: >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#answers the current period against its allowance: committed, utilisation and a warned status category: failure test_sources: - >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#answers the current period against its allowance: committed, utilisation and a warned status - >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#answers the recent refusals and failures, newest first - >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#answers a hard stopped status at all of the allowance - >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#still answers the current period, the limits, the overrides and the periods - id: ATS-PFM-LLM-011-04 title: Historical capacity uses the relevant instant level: api proves: - BR-CAP-PFM-LLM-011-04 preconditions: 'Grants cover a prior month-end, now, expiry and revocation.' steps: Read monthly histories. expected: >- Prior periods use month-end capacity and the current period uses active capacity now, excluding expired and revoked grants. negative: false data_needs: 'Fixtures representing grants cover a prior month-end, now, expiry and revocation.' bound_to: - TST-PFM-LLM-050 provenance: test source: >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#reads each recent period’s credits at the instant that decided it: now for this month, its last instant for last category: rule test_sources: - >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#reads each recent period’s credits at the instant that decided it: now for this month, its last instant for last - >- services-platform:modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js#counts neither a revoked override nor a finished one in the current month - id: ATS-PFM-LLM-011-05 title: Filters and cursors have bounded results level: api proves: - BR-CAP-PFM-LLM-011-05 preconditions: The organization has several request outcomes. steps: 'Filter and paginate requests, then submit invalid status and cursor values.' expected: Matching rows appear newest-first without repetition and invalid inputs are rejected. negative: true data_needs: Fixtures representing the organization has several request outcomes. bound_to: - TST-PFM-LLM-009 provenance: test source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers the invocations newest first, narrowed by a filter, as pairs of money category: validation test_sources: - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers the invocations newest first, narrowed by a filter, as pairs of money - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#pages the invocations with a cursor and a tie-breaker - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers 400 for a status the invocation table does not have - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers 400 for a cursor this list did not make, before the tenant is read - id: ATS-PFM-LLM-011-06 title: Routine request reads keep content private level: browser proves: - BR-CAP-PFM-LLM-011-06 - INV-DOM-PFM-LLM-004-05 preconditions: Requests have retained evidence bodies. steps: Read lists and details through service and console surfaces. expected: Capture statuses appear without body text or storage references. negative: false data_needs: Fixtures representing requests have retained evidence bodies. bound_to: - TST-PFM-LLM-009 - TST-PFM-LLM-002 provenance: test source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers the capture status of a request’s bodies and never a storage key category: invariant test_sources: - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers the capture status of a request’s bodies and never a storage key - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#carries no storage key in the list either - >- react-console:e2e/mock/hq-ai-usage.mock.spec.ts#asks for an organization first, then filters its requests without ever showing prompt text - id: ATS-PFM-LLM-011-07 title: Grant lists derive current window state level: api proves: - BR-CAP-PFM-LLM-011-09 preconditions: 'Scheduled, active, expired and revoked grants exist.' steps: Read all grants and the active-only list. expected: 'States reflect read time and newest-start order, with active-only returning eligible grants.' negative: false data_needs: 'Fixtures representing scheduled, active, expired and revoked grants exist.' bound_to: - TST-PFM-LLM-029 - TST-PFM-LLM-009 provenance: test source: >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#answers each override with the state it has now, newest start first category: transition test_sources: - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#answers each override with the state it has now, newest start first - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#answers only those in force when asked for the active ones - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers the overrides with a derived state, all or only those in force - id: ATS-PFM-LLM-011-08 title: Console role controls remain distinct level: browser proves: - BR-CAP-PFM-LLM-011-12 preconditions: Support and administrator staff sessions are available. steps: Open the organization usage card as each. expected: Support has no action menu and the administrator has the management menu. negative: false data_needs: Fixtures representing support and administrator staff sessions are available. bound_to: - TST-PFM-LLM-002 provenance: test source: >- react-console:e2e/mock/hq-ai-usage.mock.spec.ts#a Support Representative reads the card but has no action menu and no write controls category: permission test_sources: - >- react-console:e2e/mock/hq-ai-usage.mock.spec.ts#a Support Representative reads the card but has no action menu and no write controls - >- react-console:e2e/mock/hq-ai-usage.mock.spec.ts#an administrator has the action menu, with its two writes inert - id: ATS-PFM-LLM-011-09 title: Refusal detail joins history to explanation category: interaction level: browser proves: - BR-CAP-PFM-LLM-011-06 - BR-CAP-PFM-LLM-012-02 exercises: - CAP-PFM-LLM-011 - CAP-PFM-LLM-012 preconditions: An organization’s directory includes a refused request with retained decision figures. steps: Open the request detail and its explanation from the directory. expected: >- The detail and explanation name the same outcome and separate original figures from present admission without exposing captured text. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts' - 'services-platform:modules/llm/services/explain/explain-invocation.ts' - id: ATS-PFM-LLM-011-10 title: A saved limit appears in account inspection category: interaction level: api proves: - BR-CAP-PFM-LLM-011-03 - BR-CAP-PFM-LLM-013-06 exercises: - CAP-PFM-LLM-011 - CAP-PFM-LLM-013 preconditions: A manager inspects current limits and the current period has usage. steps: Change the base allowance at the inspected version and read overview and audit. expected: >- Current base and configuration version change together with the reasoned audit while charges and holds remain intact. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/services/usage-reports/tenant-usage.ts' - 'services-platform:modules/llm/services/limits/tenant-limits.ts' - id: ATS-PFM-LLM-011-11 title: Grant inspection follows revocation category: interaction level: api proves: - BR-CAP-PFM-LLM-011-09 - BR-CAP-PFM-LLM-014-07 exercises: - CAP-PFM-LLM-011 - CAP-PFM-LLM-014 preconditions: An organization has scheduled and active grants. steps: 'Read all and active-only lists, revoke the active grant and read again.' expected: >- Revocation preserves original grant values and its reason while removing that grant from active capacity. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: - TST-PFM-LLM-029 provenance: test source: - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#answers only those in force when asked for the active ones - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#leaves the grant’s own fields as they were: an override is revoked, never edited - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#stops the override applying to the next call test_sources: - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#answers only those in force when asked for the active ones - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#leaves the grant’s own fields as they were: an override is revoked, never edited - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#stops the override applying to the next call - id: ATS-PFM-LLM-011-12 title: Correction appears in account and audit history category: interaction level: api proves: - BR-CAP-PFM-LLM-011-11 - BR-CAP-PFM-LLM-015-06 exercises: - CAP-PFM-LLM-011 - CAP-PFM-LLM-015 preconditions: A manager applies a valid signed correction for an existing month. steps: 'Read the month, correction history and AI audit history.' expected: >- The changed balance agrees with the recorded correction and one attributed audit event; request settlements remain unchanged. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/services/usage-reports/tenant-usage.ts' - 'services-platform:modules/llm/services/adjustments/adjust-allowance.ts' - id: ATS-PFM-LLM-011-13 title: Routine metadata never opens captured content category: interaction level: api proves: - BR-CAP-PFM-LLM-011-06 - BR-CAP-PFM-LLM-016-01 exercises: - CAP-PFM-LLM-011 - CAP-PFM-LLM-016 preconditions: >- Captured bodies exist and a support reader can inspect the account but lacks sensitive content authority. steps: Open request metadata and attempt a dedicated body read. expected: >- Metadata shows only capture state; the dedicated read refuses without revealing body or storage reference. negative: true data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts' - 'services-platform:modules/llm/services/evidence/evidence-access.ts' - id: ATS-PFM-LLM-011-14 title: Deployed HQ reads reach request detail category: boundary level: browser proves: - BR-CAP-PFM-LLM-011-03 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: >- Sign in as the seeded Rhythm administrator; open reporting, the organization card, its directory and one request. expected: >- The summary and overview return successfully, the directory has linked rows and request identity and capture-state sections render. negative: false data_needs: Existing seeded development data and Rhythm administrator credentials; the suite reads only. bound_to: - TST-PFM-LLM-001 provenance: test source: >- react-console:e2e/dev/hq-ai-usage.dev.spec.ts#the page, an organization's card and the request directory read Platform test_sources: - >- react-console:e2e/dev/hq-ai-usage.dev.spec.ts#the page, an organization's card and the request directory read Platform - id: ATS-PFM-LLM-011-15 title: Task reads do not cross workspace scope category: boundary level: api proves: - BR-CAP-PFM-LLM-011-02 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: Read the seeded task through its own and another workspace context. expected: The owner receives the mapped task while the foreign context receives no task. negative: false data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-033 provenance: test source: >- services-platform:modules/llm/tests/integration/services/persistence/executions.queries.integration.spec.js#does not answer to another tenant, whose row-level security hides it test_sources: - >- services-platform:modules/llm/tests/integration/services/persistence/executions.queries.integration.spec.js#does not answer to another tenant, whose row-level security hides it - id: ATS-PFM-LLM-011-16 title: Request windows use half-open bounds category: boundary level: api proves: - BR-CAP-PFM-LLM-011-05 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: List a request window containing records at its start and end instants. expected: The start record appears and the end record does not. negative: false data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-035 provenance: test source: >- services-platform:modules/llm/tests/integration/services/persistence/invocations.queries.integration.spec.js#answers a call at the very start of the window but not one at its end test_sources: - >- services-platform:modules/llm/tests/integration/services/persistence/invocations.queries.integration.spec.js#answers a call at the very start of the window but not one at its end - id: ATS-PFM-LLM-011-17 title: Request paging rejects foreign cursor shapes category: validation level: unit proves: - BR-CAP-PFM-LLM-011-05 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: Submit a valid paging cursor and a cursor made for another list. expected: Only the matching list cursor is accepted. negative: true data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-052 provenance: test source: >- services-platform:modules/llm/tests/unit/aws/api/llm-usage-api-mapper.spec.ts#refuses a cursor from another list test_sources: - >- services-platform:modules/llm/tests/unit/aws/api/llm-usage-api-mapper.spec.ts#refuses a cursor from another list - id: ATS-PFM-LLM-011-18 title: Console mapping preserves unavailable sections category: failure level: unit proves: - BR-CAP-PFM-LLM-011-03 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: Unwrap available and unavailable usage sections through the console mapper. expected: The available value is retained and the unavailable section raises its dedicated failure. negative: true data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-004 provenance: test source: 'react-console:lib/hq/ai-usage.test.ts#unwraps an available section and refuses an unavailable one' test_sources: - 'react-console:lib/hq/ai-usage.test.ts#unwraps an available section and refuses an unavailable one' evidence: - >- services-platform at ad3f6a6582843008ed0f5a17b131878d15829af1: bound or cited modules/llm/tests/e2e/llm-usage.e2e.spec.js; modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js; modules/llm/tests/integration/services/usage-reports/tenant-usage.integration.spec.js. - >- react-console at baf6dae382d6f41dce976c7f848667ccc37e076f: bound or cited e2e/mock/hq-ai-usage.mock.spec.ts. coverage: rule: 'gap: FND-PFM-LLM-070' transition: 'gap: FND-PFM-LLM-070' validation: covered permission: covered edge: 'gap: FND-PFM-LLM-070' failure: covered boundary: covered concurrency: 'gap: FND-PFM-LLM-070' invariant: 'gap: FND-PFM-LLM-070' interaction: covered coverage_notes: transition: >- Existing transition scenarios are retained; the model transition register below records the remaining exhaustive mapping obligation. interaction: >- The related interaction register cites a concrete experiment for every dependency and related capability, including cross-capability workflow seams. invariant: >- The domain-invariant register maps each relevant invariant to a scenario or to the capability coverage finding; an example does not establish every invariant. rule: >- All must-prove rules have scenario references, but the coverage finding retains untested clauses and combined outcomes; scenario presence alone is not exhaustive rule proof. related_interactions: - with: CAP-PFM-LLM-003 scenarios: - ATS-PFM-LLM-003-09 source: 'services-platform:modules/llm/services/execution/with-llm-execution.ts' - with: CAP-PFM-LLM-007 scenarios: - ATS-PFM-LLM-007-14 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - with: CAP-PFM-LLM-008 scenarios: - ATS-PFM-LLM-008-11 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - with: CAP-PFM-LLM-010 scenarios: - ATS-PFM-LLM-010-09 source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator, whatever they hold at their customer’s scope - with: CAP-PFM-LLM-012 scenarios: - ATS-PFM-LLM-011-09 source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused 403 for a customer’s administrator, because the route is system - with: CAP-PFM-LLM-013 scenarios: - ATS-PFM-LLM-011-10 source: >- services-platform:modules/llm/tests/e2e/llm-limits.e2e.spec.js#is refused the write before a handler runs, whatever the customer’s scope grants - with: CAP-PFM-LLM-014 scenarios: - ATS-PFM-LLM-011-11 source: >- services-platform:modules/llm/tests/e2e/llm-overrides.e2e.spec.js#is refused the grant before a handler runs, whatever the customer’s scope grants - with: CAP-PFM-LLM-015 scenarios: - ATS-PFM-LLM-011-12 source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused 403 for a Support Representative, who holds the read key and not the manage key - with: CAP-PFM-LLM-016 scenarios: - ATS-PFM-LLM-011-13 source: 'services-platform:modules/llm/services/evidence/evidence-access.ts' state_models: - STATE-PFM-LLM-005 - STATE-PFM-LLM-007 coverage_obligations: must_prove: - rule: BR-CAP-PFM-LLM-011-01 scenarios: - ATS-PFM-LLM-011-01 source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator a tenant’s usage even in their own tenant coverage: specified - rule: BR-CAP-PFM-LLM-011-02 scenarios: - ATS-PFM-LLM-011-02 - ATS-PFM-LLM-011-15 source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers 404 for a request of another tenant, the tenant policy binding the read coverage: specified - rule: BR-CAP-PFM-LLM-011-03 scenarios: - ATS-PFM-LLM-011-03 - ATS-PFM-LLM-011-10 - ATS-PFM-LLM-011-14 - ATS-PFM-LLM-011-18 source: 'services-platform:modules/llm/services/usage-reports/tenant-usage.ts' coverage: partial gap: FND-PFM-LLM-070 - rule: BR-CAP-PFM-LLM-011-04 scenarios: - ATS-PFM-LLM-011-04 source: 'services-platform:modules/llm/services/usage-reports/tenant-usage.ts' coverage: specified - rule: BR-CAP-PFM-LLM-011-05 scenarios: - ATS-PFM-LLM-011-05 - ATS-PFM-LLM-011-16 - ATS-PFM-LLM-011-17 source: 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts' coverage: partial gap: FND-PFM-LLM-070 - rule: BR-CAP-PFM-LLM-011-06 scenarios: - ATS-PFM-LLM-011-06 - ATS-PFM-LLM-011-09 - ATS-PFM-LLM-011-13 source: 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts' coverage: partial gap: FND-PFM-LLM-070 - rule: BR-CAP-PFM-LLM-011-09 scenarios: - ATS-PFM-LLM-011-07 - ATS-PFM-LLM-011-11 source: >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#answers each override with the state it has now, newest start first coverage: specified - rule: BR-CAP-PFM-LLM-011-12 scenarios: - ATS-PFM-LLM-011-08 source: >- react-console:e2e/mock/hq-ai-usage.mock.spec.ts#a Support Representative reads the card but has no action menu and no write controls coverage: partial gap: FND-PFM-LLM-070 state_transitions: - model: STATE-PFM-LLM-005 transition: 1 from: within to: warned trigger: Commitments increase or effective capacity decreases into warning range. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 2 from: warned to: hard_stopped trigger: Committed usage reaches full effective capacity. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 3 from: within to: hard_stopped trigger: A large movement skips directly from below warning to full usage. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 4 from: hard_stopped to: within trigger: 'Capacity rises, commitments fall or the month changes.' gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:grantOverride' - model: STATE-PFM-LLM-005 transition: 5 from: hard_stopped to: warned trigger: Capacity returns without removing the warning. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 6 from: warned to: within trigger: Capacity increases or commitments decrease below warning. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 7 from: within to: disabled trigger: The AI switch is disabled or organization availability changes. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/limits/tenant-limits.ts:checkOperationAccess' - model: STATE-PFM-LLM-005 transition: 8 from: disabled to: within trigger: AI and organization availability return. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/limits/tenant-limits.ts:upsertTenantLimits' - model: STATE-PFM-LLM-007 transition: 1 from: absent to: active trigger: A manager creates capacity starting immediately. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:grantOverride' - model: STATE-PFM-LLM-007 transition: 2 from: absent to: scheduled trigger: A manager creates capacity with a future start. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:grantOverride' - model: STATE-PFM-LLM-007 transition: 3 from: scheduled to: active trigger: Time reaches the grant’s start. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts:authorizeCredits' - model: STATE-PFM-LLM-007 transition: 4 from: active to: expired trigger: Time reaches the grant’s end. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts:authorizeCredits' - model: STATE-PFM-LLM-007 transition: 5 from: active to: revoked trigger: A manager revokes currently active capacity. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:revokeOverride' - model: STATE-PFM-LLM-007 transition: 6 from: scheduled to: revoked trigger: A manager revokes scheduled capacity. gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:revokeOverride' domain_invariants: - invariant: INV-DOM-PFM-LLM-004-05 scenarios: - ATS-PFM-LLM-011-06 provenance: documented source: 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts:toInvocationDetailResponse' - invariant: INV-DOM-PFM-LLM-004-07 scenarios: - ATS-PFM-LLM-011-03 provenance: documented source: 'services-platform:modules/llm/services/usage-reports/section.ts:readSection' - invariant: INV-DOM-PFM-LLM-004-08 scenarios: [] gap: FND-PFM-LLM-070 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' coverage_limits: finding: FND-PFM-LLM-070 statement: >- All independent section failures, complete task-to-request navigation and concurrent account changes need additional cases. Mocked browser data does not establish agreement with real ledger reads. provenance: proposed source: - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator a tenant’s usage even in their own tenant - >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#answers 404 for a request of another tenant, the tenant policy binding the read - 'services-platform:modules/llm/services/usage-reports/tenant-usage.ts' - 'services-platform:modules/llm/services/usage-reports/tenant-usage.ts' - 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts' - 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts' - >- services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#answers each override with the state it has now, newest start first - >- react-console:e2e/mock/hq-ai-usage.mock.spec.ts#a Support Representative reads the card but has no action menu and no write controls - 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' invariants_without_scenarios: - INV-DOM-PFM-LLM-004-08 --- # Inspect an organization’s AI account and request history: Capability Test Specification ## Coverage | Rule | Scenario | |---|---| | `BR-CAP-PFM-LLM-011-01` | `ATS-PFM-LLM-011-01` | | `BR-CAP-PFM-LLM-011-02` | `ATS-PFM-LLM-011-02` | | `BR-CAP-PFM-LLM-011-03` | `ATS-PFM-LLM-011-03` | | `BR-CAP-PFM-LLM-011-04` | `ATS-PFM-LLM-011-04` | | `BR-CAP-PFM-LLM-011-05` | `ATS-PFM-LLM-011-05` | | `BR-CAP-PFM-LLM-011-06` | `ATS-PFM-LLM-011-06` | | `BR-CAP-PFM-LLM-011-09` | `ATS-PFM-LLM-011-07` | | `BR-CAP-PFM-LLM-011-12` | `ATS-PFM-LLM-011-08` | ## Interactions With Related Capabilities The interaction register links concrete experiments with keep one account for a multi-request ai task; admit ai work against the organization’s monthly allowance; notify administrators at allowance thresholds; monitor ai usage across organizations; explain an ai refusal or unsuccessful conversation; set an organization’s ai access and recurring limits; provide temporary ai capacity and revoke it; correct an organization’s ai charges; inspect captured ai content with a live access grant. Each experiment checks the outcome at the shared boundary; an unbound experiment remains proposed. All independent section failures, complete task-to-request navigation and concurrent account changes need additional cases. Mocked browser data does not establish agreement with real ledger reads.