---
id: TST-PFM-NOT-109
title: permissions
kind: unit
product_area: platform
module: notifications
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/notifications/tests/unit/permissions.spec.js
implements:
  - ATS-PFM-NOT-002-06
  - ATS-PFM-NOT-009-01
  - ATS-PFM-NOT-011-01
  - ATS-PFM-NOT-012-01
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: Per-process test inputs and installed doubles.
assertion_bindings:
  - scenario: ATS-PFM-NOT-002-06
    suite: TST-PFM-NOT-109
    assertions:
      - >-
        services-platform:modules/notifications/tests/unit/permissions.spec.js#makes
        publish staff-only, so only a system route may require it, and gives it
        to the Rhythm Administrator role
  - scenario: ATS-PFM-NOT-009-01
    suite: TST-PFM-NOT-109
    assertions:
      - >-
        services-platform:modules/notifications/tests/unit/permissions.spec.js#puts
        use at tier read, so every built-in console role carries it, and open to
        customers
  - scenario: ATS-PFM-NOT-011-01
    suite: TST-PFM-NOT-109
    assertions:
      - >-
        services-platform:modules/notifications/tests/unit/permissions.spec.js#puts
        manage at tier admin and sensitive, for the Administrator
  - scenario: ATS-PFM-NOT-012-01
    suite: TST-PFM-NOT-109
    assertions:
      - >-
        services-platform:modules/notifications/tests/unit/permissions.spec.js#makes
        both HQ keys staff-only, operate sensitive
      - >-
        services-platform:modules/notifications/tests/unit/permissions.spec.js#leaves
        both HQ keys out of the HQ reader policy: the Rhythm Administrator holds
        them through hq.*.*
evidence:
  - 'services-platform:modules/notifications/tests/unit/permissions.spec.js'
  - The file and referenced assertion titles exist at the pinned commit.
dependency_evidence:
  - >-
    Real: the permission catalog the manifest is generated from. Doubled:
    nothing. Never doubled: the catalog.
---

# permissions

## Verification Boundary

This suite checks isolated calculations, validation or presentation with process-local inputs. It does not establish a deployed workflow.

## What This Suite Proves

Its cases exercise require system publication access; require personal notification permission; require notification management for History; keep HQ notification keys staff-only.

The registered scenario bindings identify the assertions this executable file contributes. They retain individual test references so that a composite scenario does not become a claim of complete execution by one file.

## What It Does Not Prove

Local outcomes do not prove deployed queues, external provider acceptance, production credentials or complete browser behavior. No fresh execution or conformance result is claimed.

## Real Dependencies and Test Doubles

The test file identifies its pure inputs or presentation doubles. Console component suites use recorded request handlers; pure validation suites require no external provider.

## Must Not Be Doubled

The calculation, validator or component under test must execute its real implementation. Doubles supply inputs and external responses without replacing the behavior being proved.