--- id: ATS-PFM-LLM-017 scope: CAP-PFM-LLM-017 product_area: platform module: llm revision: 2 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-LLM-017-01 title: Organization summary requires local console authority level: api proves: - BR-CAP-PFM-LLM-017-01 preconditions: 'Local administrator, unkeyed user, foreign administrator, anonymous and HQ-only contexts are available.' steps: Read the local summary under each context. expected: Only the appropriately authorized local administrator succeeds. negative: true data_needs: >- Fixtures representing local administrator, unkeyed user, foreign administrator, anonymous and HQ-only contexts are available. bound_to: - TST-PFM-LLM-006 provenance: test source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#answers the summary to the organization’s administrator category: permission test_sources: - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#answers the summary to the organization’s administrator - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused 403 for a console user without the key - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused to Rhythm staff holding every HQ key, because the routes are console - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused to an administrator of another customer, before any handler runs - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused an anonymous caller - id: ATS-PFM-LLM-017-02 title: Summary states usage and local renewal level: api proves: - BR-CAP-PFM-LLM-017-02 preconditions: 'An organization is at 85%, another unused and another disabled.' steps: Read their summaries. expected: >- Balances, warning message, local reset and history reflect each position, including unused and disabled states. negative: false data_needs: 'Fixtures representing an organization is at 85%, another unused and another disabled.' bound_to: - TST-PFM-LLM-051 provenance: test source: >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#states the allowance, what is used and what remains, from the live period category: rule test_sources: - >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#states the allowance, what is used and what remains, from the live period - >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#is warned at eighty-five percent, with the band and the opening sentence - >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#resets on the first of next month in the organization’s own calendar - >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#is limited for an organization whose tenant is disabled - id: ATS-PFM-LLM-017-03 title: Customer summary excludes internal commercial detail level: api proves: - BR-CAP-PFM-LLM-017-03 - INV-DOM-PFM-LLM-004-06 preconditions: Usage includes grants and custom limits. steps: Read the customer summary. expected: 'Neither keys nor text disclose money, provider, model, operation identity, grants or internal limits.' negative: false data_needs: Fixtures representing usage includes grants and custom limits. bound_to: - TST-PFM-LLM-006 provenance: test source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#carries no key naming money, a provider, a model, an override or a limit on the summary category: invariant test_sources: - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#carries no key naming money, a provider, a model, an override or a limit on the summary - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#carries no model name, provider name or operation key anywhere in the summary text - id: ATS-PFM-LLM-017-04 title: Features explain current restriction level: api proves: - BR-CAP-PFM-LLM-017-04 preconditions: 'An operation is enabled with capacity, then disabled.' steps: Read the feature list before and after disablement. expected: Availability changes to restriction with its disabled-feature explanation. negative: false data_needs: 'Fixtures representing an operation is enabled with capacity, then disabled.' bound_to: - TST-PFM-LLM-006 - TST-PFM-LLM-051 provenance: test source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#answers the features, available while the organization has credits category: rule test_sources: - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#answers the features, available while the organization has credits - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#restricts the feature with the sentence when the organization turns it off - >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#lists the feature as available while credits remain and the operation is on - id: ATS-PFM-LLM-017-05 title: Active exemptions expose a feature-list mismatch level: api proves: - BR-CAP-PFM-LLM-017-05 preconditions: The only feature operation is disabled but has an active exemption. steps: Read availability and request operation admission. expected: Admission allows it while the feature list still says restricted. negative: false data_needs: Fixtures representing the only feature operation is disabled but has an active exemption. bound_to: [] provenance: proposed source: >- services-platform:docs/milestones/PLAT-M3-ai-usage-organization-page.md#State found on 2026-10-19 (re-inspected) category: edge test_sources: [] - id: ATS-PFM-LLM-017-06 title: Unknown historical operations have an Other group level: api proves: - BR-CAP-PFM-LLM-017-06 preconditions: Both declared and no-longer-declared operations have usage. steps: Read usage by feature. expected: Declared usage appears in its feature and the remainder in Other AI features. negative: false data_needs: Fixtures representing both declared and no-longer-declared operations have usage. bound_to: - TST-PFM-LLM-051 provenance: test source: >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#sums the period’s requests and credits by feature and groups an undeclared operation as other category: rule test_sources: - >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#sums the period’s requests and credits by feature and groups an undeclared operation as other - id: ATS-PFM-LLM-017-07 title: Customer periods stay organization-scoped level: api proves: - BR-CAP-PFM-LLM-017-07 - INV-DOM-PFM-LLM-001-11 preconditions: Two organizations have usage in the same month. steps: Read one customer summary. expected: All reported figures belong to that organization. negative: false data_needs: Fixtures representing two organizations have usage in the same month. bound_to: - TST-PFM-LLM-051 provenance: test source: >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#does not read another organization’s period category: boundary test_sources: - >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#does not read another organization’s period - id: ATS-PFM-LLM-017-08 title: Reporting datasets exclude diagnostic content level: api proves: - BR-CAP-PFM-LLM-017-08 preconditions: Two organizations contain requests. steps: Query the request dataset under each organization reader. expected: 'Each reader receives only local records and no body, storage, snapshot, raw usage or version columns.' negative: false data_needs: Fixtures representing two organizations contain requests. bound_to: - TST-PFM-LLM-013 provenance: test source: >- services-platform:modules/llm/tests/integration/db/llm-invocations-query.view.integration.spec.js#answers the tenant’s own two requests to the query reader, newest last, and not the other tenant’s category: invariant test_sources: - >- services-platform:modules/llm/tests/integration/db/llm-invocations-query.view.integration.spec.js#answers the tenant’s own two requests to the query reader, newest last, and not the other tenant’s - >- services-platform:modules/llm/tests/integration/db/llm-invocations-query.view.integration.spec.js#offers none of the evidence, payload, refusal, usage or version columns - id: ATS-PFM-LLM-017-09 title: Planned customer dashboard remains a delivery obligation level: browser proves: - BR-CAP-PFM-LLM-017-09 preconditions: An organization administrator has usage to review. steps: Open the intended Tools and Dashboards AI Usage page. expected: >- The product should show credit position, renewal, feature states, recent monthly trend, pause wording and request navigation without money. negative: false data_needs: Fixtures representing an organization administrator has usage to review. bound_to: [] provenance: proposed source: 'services-platform:docs/milestones/PLAT-M3-ai-usage-organization-page.md#Scope in one paragraph' category: rule test_sources: [] - id: ATS-PFM-LLM-017-10 title: Customer review agrees with HQ level: api proves: - AS-JNY-PFM-LLM-004-01 - AS-JNY-PFM-LLM-004-02 preconditions: Usage and a disabled feature exist for one organization. steps: Follow the administrator review journey and compare its results with HQ. expected: Credit position agrees across the two views and the feature explains its restriction. negative: false data_needs: Fixtures representing usage and a disabled feature exist for one organization. bound_to: [] provenance: proposed source: FND-PFM-LLM-027 category: interaction test_sources: [] - id: ATS-PFM-LLM-017-11 title: Customer summary uses the refusal vocabulary category: interaction level: api proves: - BR-CAP-PFM-LLM-017-02 - BR-CAP-PFM-LLM-018-01 exercises: - CAP-PFM-LLM-017 - CAP-PFM-LLM-018 preconditions: The organization has exhausted its allowance and has a known reset date. steps: Read the summary and derive the allowance-refusal sentence at that reset. expected: 'The summary and sentence share renewal guidance and exclude internal money, model and provider wording.' negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/services/usage/organization-usage.ts' - >- services-platform:modules/llm/tests/unit/services/usage/usage-sentences.spec.ts#tells an organization that has used its allowance when it resumes - id: ATS-PFM-LLM-017-12 title: Customer mapping withholds internal commercial fields category: rule level: unit proves: - BR-CAP-PFM-LLM-017-03 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: Map a period containing credits and internal money and model detail to the customer summary. expected: Only customer-facing credit and percentage details are retained. negative: false data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-083 provenance: test source: >- services-platform:modules/llm/tests/unit/services/usage/organization-usage.spec.ts#has no key naming money, a provider, a model, an override or a limit on the summary test_sources: - >- services-platform:modules/llm/tests/unit/services/usage/organization-usage.spec.ts#has no key naming money, a provider, a model, an override or a limit on the summary - id: ATS-PFM-LLM-017-13 title: Every declared feature has readable descriptions category: rule level: unit proves: - BR-CAP-PFM-LLM-017-04 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: Read catalog features with their declared labels and descriptions. expected: Every declared feature has a label and explanatory line rather than exposing only an internal key. negative: false data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-084 provenance: test source: >- services-platform:modules/llm/tests/unit/services/usage/usage-features.spec.ts#describes every feature the catalog declares, with a label and a line test_sources: - >- services-platform:modules/llm/tests/unit/services/usage/usage-features.spec.ts#describes every feature the catalog declares, with a label and a line evidence: - >- services-platform at ad3f6a6582843008ed0f5a17b131878d15829af1: bound or cited docs/milestones/PLAT-M3-ai-usage-organization-page.md; modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js; modules/llm/tests/integration/db/llm-invocations-query.view.integration.spec.js; modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js. coverage: rule: 'gap: FND-PFM-LLM-076' transition: 'gap: FND-PFM-LLM-076' validation: 'gap: FND-PFM-LLM-076' permission: covered edge: covered failure: 'gap: FND-PFM-LLM-076' boundary: covered concurrency: 'gap: FND-PFM-LLM-076' invariant: covered interaction: covered coverage_notes: transition: >- Existing transition scenarios are retained; the model transition register below records the remaining exhaustive mapping obligation. interaction: >- The related interaction register cites a concrete experiment for every dependency and related capability, including cross-capability workflow seams. rule: >- All must-prove rules have scenario references, but the coverage finding retains untested clauses and combined outcomes; scenario presence alone is not exhaustive rule proof. related_interactions: - with: CAP-PFM-LLM-007 scenarios: - ATS-PFM-LLM-007-19 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - with: CAP-PFM-LLM-013 scenarios: - ATS-PFM-LLM-013-11 source: >- services-platform:modules/llm/tests/e2e/llm-limits.e2e.spec.js#is refused the write before a handler runs, whatever the customer’s scope grants - with: CAP-PFM-LLM-018 scenarios: - ATS-PFM-LLM-017-11 source: >- services-platform:modules/llm/tests/unit/services/usage/usage-sentences.spec.ts#tells an organization that has used its allowance when it resumes state_models: - STATE-PFM-LLM-005 coverage_obligations: must_prove: - rule: BR-CAP-PFM-LLM-017-01 scenarios: - ATS-PFM-LLM-017-01 source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused to Rhythm staff holding every HQ key, because the routes are console coverage: specified - rule: BR-CAP-PFM-LLM-017-02 scenarios: - ATS-PFM-LLM-017-02 - ATS-PFM-LLM-017-11 source: 'services-platform:modules/llm/services/usage/organization-usage.ts' coverage: partial gap: FND-PFM-LLM-076 - rule: BR-CAP-PFM-LLM-017-03 scenarios: - ATS-PFM-LLM-017-03 - ATS-PFM-LLM-017-12 source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#carries no key naming money, a provider, a model, an override or a limit on the summary coverage: specified - rule: BR-CAP-PFM-LLM-017-04 scenarios: - ATS-PFM-LLM-017-04 - ATS-PFM-LLM-017-13 source: 'services-platform:modules/llm/services/usage/organization-usage.ts' coverage: partial gap: FND-PFM-LLM-076 - rule: BR-CAP-PFM-LLM-017-05 scenarios: - ATS-PFM-LLM-017-05 source: 'services-platform:modules/llm/services/usage/organization-usage.ts:restrictionOf' coverage: partial gap: FND-PFM-LLM-076 - rule: BR-CAP-PFM-LLM-017-06 scenarios: - ATS-PFM-LLM-017-06 source: 'services-platform:modules/llm/services/usage/organization-usage.ts' coverage: specified - rule: BR-CAP-PFM-LLM-017-07 scenarios: - ATS-PFM-LLM-017-07 source: >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#does not read another organization’s period coverage: specified - rule: BR-CAP-PFM-LLM-017-08 scenarios: - ATS-PFM-LLM-017-08 source: >- services-platform:modules/llm/tests/integration/db/llm-invocations-query.view.integration.spec.js#offers none of the evidence, payload, refusal, usage or version columns coverage: partial gap: FND-PFM-LLM-076 - rule: BR-CAP-PFM-LLM-017-09 scenarios: - ATS-PFM-LLM-017-09 source: 'services-platform:docs/milestones/PLAT-M3-ai-usage-organization-page.md#Scope in one paragraph' coverage: partial gap: FND-PFM-LLM-076 state_transitions: - model: STATE-PFM-LLM-005 transition: 1 from: within to: warned trigger: Commitments increase or effective capacity decreases into warning range. gap: FND-PFM-LLM-076 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 2 from: warned to: hard_stopped trigger: Committed usage reaches full effective capacity. gap: FND-PFM-LLM-076 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 3 from: within to: hard_stopped trigger: A large movement skips directly from below warning to full usage. gap: FND-PFM-LLM-076 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 4 from: hard_stopped to: within trigger: 'Capacity rises, commitments fall or the month changes.' gap: FND-PFM-LLM-076 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:grantOverride' - model: STATE-PFM-LLM-005 transition: 5 from: hard_stopped to: warned trigger: Capacity returns without removing the warning. gap: FND-PFM-LLM-076 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 6 from: warned to: within trigger: Capacity increases or commitments decrease below warning. gap: FND-PFM-LLM-076 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 7 from: within to: disabled trigger: The AI switch is disabled or organization availability changes. gap: FND-PFM-LLM-076 provenance: proposed source: 'services-platform:modules/llm/services/limits/tenant-limits.ts:checkOperationAccess' - model: STATE-PFM-LLM-005 transition: 8 from: disabled to: within trigger: AI and organization availability return. gap: FND-PFM-LLM-076 provenance: proposed source: 'services-platform:modules/llm/services/limits/tenant-limits.ts:upsertTenantLimits' domain_invariants: - invariant: INV-DOM-PFM-LLM-004-06 scenarios: - ATS-PFM-LLM-017-03 provenance: documented source: 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts:toOrganizationSummaryResponse' - invariant: INV-DOM-PFM-LLM-001-11 scenarios: - ATS-PFM-LLM-017-07 provenance: documented source: 'services-platform:docs/llm.md#The tables' coverage_limits: finding: FND-PFM-LLM-076 statement: >- Every live-position transition and the complete customer dashboard journey remain unproved. Exemption availability disagreement needs an executable paired admission and reporting check. provenance: proposed source: - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused to Rhythm staff holding every HQ key, because the routes are console - 'services-platform:modules/llm/services/usage/organization-usage.ts' - >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#carries no key naming money, a provider, a model, an override or a limit on the summary - 'services-platform:modules/llm/services/usage/organization-usage.ts' - 'services-platform:modules/llm/services/usage/organization-usage.ts:restrictionOf' - 'services-platform:modules/llm/services/usage/organization-usage.ts' - >- services-platform:modules/llm/tests/integration/services/usage/organization-usage.integration.spec.js#does not read another organization’s period - >- services-platform:modules/llm/tests/integration/db/llm-invocations-query.view.integration.spec.js#offers none of the evidence, payload, refusal, usage or version columns - 'services-platform:docs/milestones/PLAT-M3-ai-usage-organization-page.md#Scope in one paragraph' invariants_without_scenarios: [] --- # Show administrators their organization’s AI allowance: Capability Test Specification ## Coverage | Rule | Scenario | |---|---| | `BR-CAP-PFM-LLM-017-01` | `ATS-PFM-LLM-017-01` | | `BR-CAP-PFM-LLM-017-02` | `ATS-PFM-LLM-017-02` | | `BR-CAP-PFM-LLM-017-03` | `ATS-PFM-LLM-017-03` | | `BR-CAP-PFM-LLM-017-04` | `ATS-PFM-LLM-017-04` | | `BR-CAP-PFM-LLM-017-05` | `ATS-PFM-LLM-017-05` | | `BR-CAP-PFM-LLM-017-06` | `ATS-PFM-LLM-017-06` | | `BR-CAP-PFM-LLM-017-07` | `ATS-PFM-LLM-017-07` | | `BR-CAP-PFM-LLM-017-08` | `ATS-PFM-LLM-017-08` | | `BR-CAP-PFM-LLM-017-09` | `ATS-PFM-LLM-017-09` | ## Interactions With Related Capabilities The interaction register links concrete experiments with admit ai work against the organization’s monthly allowance; set an organization’s ai access and recurring limits; give people understandable ai refusal messages. Each experiment checks the outcome at the shared boundary; an unbound experiment remains proposed. Every live-position transition and the complete customer dashboard journey remain unproved. Exemption availability disagreement needs an executable paired admission and reporting check.