--- id: FAS-PFM-LLM-05 title: Rhythm HQ AI Controls acceptance feature: FEAT-PFM-LLM-05 product_area: platform module: llm revision: 1 status: proposed product_intent: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f rhythm-v2-docs: 9b95399181c8ec6670ce3d12d700e59643668692 capabilities: - CAP-PFM-LLM-013 - CAP-PFM-LLM-014 - CAP-PFM-LLM-015 - CAP-PFM-LLM-016 scenarios: - id: FAS-PFM-LLM-05-01 title: Reasoned controls retain a joined audit history kind: behaviour exercises: - CAP-PFM-LLM-013 - CAP-PFM-LLM-014 - CAP-PFM-LLM-015 - CAP-PFM-LLM-016 relies_on: - ATS-PFM-LLM-013-07 - ATS-PFM-LLM-014-06 - ATS-PFM-LLM-015-06 - ATS-PFM-LLM-016-02 preconditions: >- A manager changes limits, creates capacity and corrects a charge; a sensitive reader holds an eligible access grant. steps: 'Commit each valid control and read captured content, then inspect the organization’s AI audit history.' expected: >- Each accepted control retains actor and reason, successful content access has its own content-free audit and charges remain traceable. negative: false data_needs: >- An isolated workspace with stated usage, callers, clock instants and a separate workspace for scope checks. bound_to: [] provenance: proposed source: - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-013-set-what-ai-an-organization-may-use-and-how-much.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-014-grant-and-revoke-temporary-ai-capacity.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-015-correct-what-an-organization-was-charged-for-ai.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-016-read-a-captured-prompt-or-response-under-an-access-grant.md - id: FAS-PFM-LLM-05-02 title: Temporary capacity does not override global AI disablement kind: interaction exercises: - CAP-PFM-LLM-013 - CAP-PFM-LLM-014 relies_on: - ATS-PFM-LLM-013-09 - ATS-PFM-LLM-014-07 preconditions: An operation exemption is active and organization-wide AI is enabled. steps: 'Disable global AI, check access, re-enable it and revoke the exemption.' expected: >- Global disablement prevents access despite the exemption; re-enablement restores operation-only evaluation and revocation ends the exemption. negative: false data_needs: >- An isolated workspace with stated usage, callers, clock instants and a separate workspace for scope checks. bound_to: [] provenance: proposed source: - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-013-set-what-ai-an-organization-may-use-and-how-much.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-014-grant-and-revoke-temporary-ai-capacity.md - id: FAS-PFM-LLM-05-03 title: Capacity can be scheduled and revoked before start kind: lifecycle exercises: - CAP-PFM-LLM-013 - CAP-PFM-LLM-014 - CAP-PFM-LLM-015 relies_on: - ATS-PFM-LLM-014-03 - ATS-PFM-LLM-014-07 - ATS-PFM-LLM-015-06 preconditions: A future capacity window follows a reasoned base-limit change and correction. steps: >- Create the scheduled grant, revoke it before start and inspect limits, corrections and capacity at the start instant. expected: >- The revoked grant contributes no capacity; original grant details, base configuration and signed correction remain separately inspectable. negative: false data_needs: >- An isolated workspace with stated usage, callers, clock instants and a separate workspace for scope checks. bound_to: [] provenance: proposed source: - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-013-set-what-ai-an-organization-may-use-and-how-much.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-014-grant-and-revoke-temporary-ai-capacity.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-015-correct-what-an-organization-was-charged-for-ai.md - id: FAS-PFM-LLM-05-04 title: Control authority and content authority remain distinct kind: permission exercises: - CAP-PFM-LLM-013 - CAP-PFM-LLM-014 - CAP-PFM-LLM-015 - CAP-PFM-LLM-016 relies_on: - ATS-PFM-LLM-013-01 - ATS-PFM-LLM-014-01 - ATS-PFM-LLM-015-01 - ATS-PFM-LLM-016-05 preconditions: 'Support, a customer administrator, a usage manager and a sensitive reader have distinct authorities.' steps: >- Attempt limit, grant, correction and content operations as each relevant caller, with and without an eligible access grant. expected: >- Read-only and customer authority cannot mutate controls; management authority alone cannot open content and content authority still needs a live eligible grant. negative: true data_needs: >- An isolated workspace with stated usage, callers, clock instants and a separate workspace for scope checks. bound_to: [] provenance: proposed source: - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-013-set-what-ai-an-organization-may-use-and-how-much.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-014-grant-and-revoke-temporary-ai-capacity.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-015-correct-what-an-organization-was-charged-for-ai.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-016-read-a-captured-prompt-or-response-under-an-access-grant.md - id: FAS-PFM-LLM-05-05 title: Repeated creates remain visible as separate facts kind: regression exercises: - CAP-PFM-LLM-013 - CAP-PFM-LLM-014 - CAP-PFM-LLM-015 relies_on: - ATS-PFM-LLM-013-05 - ATS-PFM-LLM-014-06 - ATS-PFM-LLM-015-06 preconditions: Limits are saved and grant and correction payloads are valid. steps: 'Replay unchanged limits, then submit each create payload twice and inspect history.' expected: >- Limits add no new audit while repeated grants and corrections remain separate audited records; the suite exposes their lack of replay protection. negative: true data_needs: >- An isolated workspace with stated usage, callers, clock instants and a separate workspace for scope checks. bound_to: [] provenance: proposed source: - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-013-set-what-ai-an-organization-may-use-and-how-much.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-014-grant-and-revoke-temporary-ai-capacity.md - >- rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-015-correct-what-an-organization-was-charged-for-ai.md evidence: - artifact: CAP-PFM-LLM-013 provenance: documented source: >- specs/platform/llm/planning/capabilities/CAP-PFM-LLM-013-set-what-ai-an-organization-may-use-and-how-much.md - artifact: CAP-PFM-LLM-014 provenance: documented source: specs/platform/llm/planning/capabilities/CAP-PFM-LLM-014-grant-and-revoke-temporary-ai-capacity.md - artifact: CAP-PFM-LLM-015 provenance: documented source: >- specs/platform/llm/planning/capabilities/CAP-PFM-LLM-015-correct-what-an-organization-was-charged-for-ai.md - artifact: CAP-PFM-LLM-016 provenance: documented source: >- specs/platform/llm/planning/capabilities/CAP-PFM-LLM-016-read-a-captured-prompt-or-response-under-an-access-grant.md - provenance: documented source: 'rhythm-v2-docs:specs/CONVENTIONS.md#5.3 Feature Acceptance Suite' execution_gap: FND-PFM-LLM-081 --- # Rhythm HQ AI Controls acceptance ## What the Feature Must Do as a Whole A manager changes limits, creates capacity and corrects a charge; a sensitive reader holds an eligible access grant. Commit each valid control and read captured content, then inspect the organization’s AI audit history. The suite compares the feature outcome with its capability prerequisites and keeps partial proof visible. ## Interactions Between Capabilities An operation exemption is active and organization-wide AI is enabled. Disable global AI, check access, re-enable it and revoke the exemption. The interaction scenario checks what changes across that shared boundary. Lifecycle, permission and regression scenarios preserve the wider feature obligations. ## Regression Record | Revision | Change | Scenario | Why | |---|---|---|---| | 1 | initial | all | Establish cumulative feature acceptance from the pinned capability and design baseline. |