--- id: ATS-PFM-LLM-016 scope: CAP-PFM-LLM-016 product_area: platform module: llm revision: 2 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-LLM-016-01 title: Content access requires a live eligible grant level: api proves: - BR-CAP-PFM-LLM-016-01 - BR-CAP-PFM-LLM-016-02 preconditions: Staff have the content key with either no eligible grant or a grant that later expires. steps: Read before and after the grant window. expected: 'Eligible access returns inside the window, while missing and expired grants produce audited refusals.' negative: true data_needs: >- Fixtures representing staff have the content key with either no eligible grant or a grant that later expires. bound_to: - TST-PFM-LLM-024 provenance: test source: >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#refuses a staff member holding no grant into the tenant, 403 category: permission test_sources: - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#refuses a staff member holding no grant into the tenant, 403 - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#answers the staff member before the window closes, which is the premise of the refusal after it - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#refuses the holder once the grant’s window has closed, and records the refusal - id: ATS-PFM-LLM-016-02 title: Handled content reads have content-free audit events level: api proves: - BR-CAP-PFM-LLM-016-03 preconditions: A staff reader has a grant for successful reads and none for a refusal. steps: Read a body twice and perform the missing-grant attempt. expected: 'Three events retain caller, request, body kind, grant where eligible and outcome without the body.' negative: false data_needs: Fixtures representing a staff reader has a grant for successful reads and none for a refusal. bound_to: - TST-PFM-LLM-024 provenance: test source: >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#writes one audit row for a read, saying who read which body of which invocation under which grant category: invariant test_sources: - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#writes one audit row for a read, saying who read which body of which invocation under which grant - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#writes a second row for a second read of the same body, so two reads are two rows - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#records no part of the body in the audit row - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#writes an audit row with the outcome refused for the refused read, naming no grant - id: ATS-PFM-LLM-016-03 title: Unavailable bodies return their status level: api proves: - BR-CAP-PFM-LLM-016-04 preconditions: 'Bodies are skipped, failed or purged, with another captured object missing from storage.' steps: Read each body. expected: 'The statuses are skipped, failed and purged as applicable, and noncaptured statuses avoid storage reads.' negative: false data_needs: >- Fixtures representing bodies are skipped, failed or purged, with another captured object missing from storage. bound_to: - TST-PFM-LLM-024 provenance: test source: >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#answers the status of a body that was skipped without touching the bucket category: edge test_sources: - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#answers the status of a body that was skipped without touching the bucket - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#answers purged for a row already marked purged without touching the bucket - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#answers purged when the row says captured and the bucket no longer holds the object - id: ATS-PFM-LLM-016-04 title: Not-found content follows eligible access level: api proves: - BR-CAP-PFM-LLM-016-05 preconditions: A reader has a valid grant for a foreign request and separately requests a nonexistent organization. steps: Read both references. expected: Not-found responses create no content-read audit event. negative: true data_needs: >- Fixtures representing a reader has a valid grant for a foreign request and separately requests a nonexistent organization. bound_to: - TST-PFM-LLM-024 provenance: test source: >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#answers 404 for an invocation the tenant does not have, and writes no row for it category: boundary test_sources: - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#answers 404 for an invocation the tenant does not have, and writes no row for it - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#answers 404 for a tenant that does not exist, whatever the caller holds - id: ATS-PFM-LLM-016-05 title: Reader policies omit content authority level: unit proves: - BR-CAP-PFM-LLM-016-06 preconditions: The HQ reader policy and evidence route declaration are available. steps: Inspect their requirements. expected: The reader has no management or evidence key and the route requires the sensitive content key. negative: false data_needs: Fixtures representing the HQ reader policy and evidence route declaration are available. bound_to: - TST-PFM-LLM-054 provenance: test source: >- services-platform:modules/llm/tests/unit/aws/api/llm-usage-permissions.spec.ts#gives the HQ reader policy neither the manage key nor the evidence key category: permission test_sources: - >- services-platform:modules/llm/tests/unit/aws/api/llm-usage-permissions.spec.ts#gives the HQ reader policy neither the manage key nor the evidence key - >- services-platform:modules/llm/tests/unit/aws/api/llm-usage-permissions.spec.ts#requires the sensitive hq.llm-usage.read-evidence, and only it, on the one evidence route - id: ATS-PFM-LLM-016-06 title: Standing access cannot authorize content category: permission level: unit proves: - BR-CAP-PFM-LLM-016-01 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: 'Evaluate active approved, emergency and standing access grants.' expected: Only the two eligible grant kinds authorize captured content inside their windows. negative: true data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-073 provenance: test source: >- services-platform:modules/llm/tests/unit/services/evidence/evidence-access.spec.ts#does not admit standing access, which is broad access for Rhythm’s administrators and not a reason to read a prompt test_sources: - >- services-platform:modules/llm/tests/unit/services/evidence/evidence-access.spec.ts#does not admit standing access, which is broad access for Rhythm’s administrators and not a reason to read a prompt evidence: - >- services-platform at ad3f6a6582843008ed0f5a17b131878d15829af1: bound or cited modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js; modules/llm/tests/unit/aws/api/llm-usage-permissions.spec.ts. coverage: rule: 'gap: FND-PFM-LLM-075' transition: not-applicable validation: 'gap: FND-PFM-LLM-075' permission: covered edge: covered failure: 'gap: FND-PFM-LLM-075' boundary: covered concurrency: 'gap: FND-PFM-LLM-075' invariant: 'gap: FND-PFM-LLM-075' interaction: covered coverage_notes: transition: This capability defines read-only presentation or validation and introduces no owned lifecycle transition. interaction: >- The related interaction register cites a concrete experiment for every dependency and related capability, including cross-capability workflow seams. invariant: >- The domain-invariant register maps each relevant invariant to a scenario or to the capability coverage finding; an example does not establish every invariant. rule: >- All must-prove rules have scenario references, but the coverage finding retains untested clauses and combined outcomes; scenario presence alone is not exhaustive rule proof. related_interactions: - with: CAP-PFM-LLM-004 scenarios: - ATS-PFM-LLM-004-06 source: 'services-platform:modules/llm/services/execution/run-operation.ts:recordCapture' - with: CAP-PFM-LLM-011 scenarios: - ATS-PFM-LLM-011-13 source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator a tenant’s usage even in their own tenant state_models: [] coverage_obligations: must_prove: - rule: BR-CAP-PFM-LLM-016-01 scenarios: - ATS-PFM-LLM-016-01 - ATS-PFM-LLM-016-06 source: 'services-platform:modules/llm/services/evidence/evidence-access.ts' coverage: partial gap: FND-PFM-LLM-075 - rule: BR-CAP-PFM-LLM-016-02 scenarios: - ATS-PFM-LLM-016-01 source: >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#refuses the holder once the grant’s window has closed, and records the refusal coverage: partial gap: FND-PFM-LLM-075 - rule: BR-CAP-PFM-LLM-016-03 scenarios: - ATS-PFM-LLM-016-02 source: 'services-platform:modules/llm/services/evidence/evidence-access.ts:readInvocationEvidence' coverage: partial gap: FND-PFM-LLM-075 - rule: BR-CAP-PFM-LLM-016-04 scenarios: - ATS-PFM-LLM-016-03 source: 'services-platform:modules/llm/services/evidence/evidence-access.ts' coverage: partial gap: FND-PFM-LLM-075 - rule: BR-CAP-PFM-LLM-016-05 scenarios: - ATS-PFM-LLM-016-04 source: 'services-platform:modules/llm/services/evidence/evidence-access.ts' coverage: partial gap: FND-PFM-LLM-075 - rule: BR-CAP-PFM-LLM-016-06 scenarios: - ATS-PFM-LLM-016-05 source: 'react-console:lib/hq/staff-roles.ts' coverage: partial gap: FND-PFM-LLM-075 state_transitions: [] domain_invariants: - invariant: INV-DOM-PFM-LLM-004-05 scenarios: [] gap: FND-PFM-LLM-075 provenance: proposed source: 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts:toInvocationDetailResponse' coverage_limits: finding: FND-PFM-LLM-075 statement: >- Route authorization, invalid body kinds, failed audit, malformed stored content and access revocation during storage reads need explicit HTTP and timing proof. Console content reads remain disabled. provenance: proposed source: - 'services-platform:modules/llm/services/evidence/evidence-access.ts' - >- services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#refuses the holder once the grant’s window has closed, and records the refusal - 'services-platform:modules/llm/services/evidence/evidence-access.ts:readInvocationEvidence' - 'services-platform:modules/llm/services/evidence/evidence-access.ts' - 'services-platform:modules/llm/services/evidence/evidence-access.ts' - 'react-console:lib/hq/staff-roles.ts' - 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts:toInvocationDetailResponse' invariants_without_scenarios: - INV-DOM-PFM-LLM-004-05 --- # Inspect captured AI content with a live access grant: Capability Test Specification ## Coverage | Rule | Scenario | |---|---| | `BR-CAP-PFM-LLM-016-01` | `ATS-PFM-LLM-016-01` | | `BR-CAP-PFM-LLM-016-02` | `ATS-PFM-LLM-016-01` | | `BR-CAP-PFM-LLM-016-03` | `ATS-PFM-LLM-016-02` | | `BR-CAP-PFM-LLM-016-04` | `ATS-PFM-LLM-016-03` | | `BR-CAP-PFM-LLM-016-05` | `ATS-PFM-LLM-016-04` | | `BR-CAP-PFM-LLM-016-06` | `ATS-PFM-LLM-016-05` | ## Interactions With Related Capabilities The interaction register links concrete experiments with retain redacted ai evidence and remove it safely; inspect an organization’s ai account and request history. Each experiment checks the outcome at the shared boundary; an unbound experiment remains proposed. Route authorization, invalid body kinds, failed audit, malformed stored content and access revocation during storage reads need explicit HTTP and timing proof. Console content reads remain disabled.