---
id: TST-PFM-MTD-072
title: custom object permission keys
kind: unit
product_area: platform
module: metadata
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts
implements:
  - ATS-PFM-MTD-011-03
  - ATS-PFM-MTD-011-04
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: >-
  Prepared integration database and the suite fixture records; fixture teardown restores or removes its own
  rows.
evidence:
  - 'services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts'
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#publishes the
    four actions of the definitions and eight of the records, history among them, and no bulk key
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#makes the
    definitions an administrator’s and reading, querying and reading the history of records everyone’s tier
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#marks exporting
    records sensitive, and no other key of the two resources
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#gives Platform
    Administrator every key of the two resources
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#gives Platform
    User reading, querying, creating and updating records and their history, and reading definitions
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#gives Platform
    Read Only reading and querying records and their history, and reading definitions
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#requires one key
    per route, each a console route, the health route public, every record route scoped to its object
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#scopes every
    record key by the resource type custom_object, and no definition key
  - >-
    services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#names only
    published keys, which the registry manifest generator accepts
fixture_imports:
  - chai
  - ../../../../aws/api/platform.routes
  - ../../../../aws/platform.service
  - ../../../security/authorizer/registry/generate-manifest
  - ../../../security/services/catalog/reconcile-catalog
  - ../../aws/api/custom-objects.routes
test_doubles: []
limitations: []
unmatched_specification: null
binding_assertions:
  - scenario: ATS-PFM-MTD-011-03
    provenance: test
    source:
      - >-
        services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#gives
        Platform Administrator every key of the two resources
      - >-
        services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#gives
        Platform User reading, querying, creating and updating records and their history, and reading
        definitions
      - >-
        services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#gives
        Platform Read Only reading and querying records and their history, and reading definitions
    note: >-
      These references identify the assertions this suite contributes; bindings to additional suites remain
      part of the scenario’s proof.
  - scenario: ATS-PFM-MTD-011-04
    provenance: test
    source:
      - >-
        services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#requires one
        key per route, each a console route, the health route public, every record route scoped to its object
    note: >-
      These references identify the assertions this suite contributes; bindings to additional suites remain
      part of the scenario’s proof.
---

# Custom object permission keys

## Verification Boundary

This unit suite checks custom objects and records within the local test harness. The registered file and pinned revision define its boundary.

## What This Suite Proves

The bindings identify the detailed or feature scenarios whose outcomes have assertions in this suite. Original case references remain attached to the detailed scenarios so a reviewer can inspect the exact assertion. Assertions are evidence of implemented checks; no execution result is claimed.

## What It Does Not Prove

The register does not establish a current passing run or full specification conformance. Behavior outside the suite’s fixtures and assertions remains unverified.

## Real Dependencies and Test Doubles

The imported contract and validation code runs locally. The fixture imports identify the setup seams; this register makes no broader claim that dependencies are undoubled.

## Must Not Be Doubled

The contract or validation function under examination must run directly; expected outputs cannot replace it.