--- id: ATS-PFM-OPS-011 scope: CAP-PFM-OPS-011 product_area: platform module: operations revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-OPS-011-01 title: Validate a reasoned decision level: api proves: - BR-CAP-PFM-OPS-011-01 - INV-DOM-PFM-OPS-003-01 preconditions: 'Override requests omit or invalidate their reason, effect or application.' steps: Attempt to save each. expected: Field validation refuses the invalid decision without a record. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses an override with no reason, with 400 naming the field evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses an override with no reason, with 400 naming the field category: validation binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses an override with no reason, with 400 naming the field - id: ATS-PFM-OPS-011-02 title: Require customer-grant expiry level: api proves: - BR-CAP-PFM-OPS-011-02 - INV-DOM-PFM-OPS-003-02 preconditions: Customer and demo workspaces receive proposed open-ended grants. steps: Save each grant. expected: The customer grant is refused and the demo grant is accepted. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a grant on a customer tenant that does not say when it ends, with 400 evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a grant on a customer tenant that does not say when it ends, with 400 category: validation binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a grant on a customer tenant that does not say when it ends, with 400 - id: ATS-PFM-OPS-011-03 title: Evaluate exact effective boundaries level: unit proves: - BR-CAP-PFM-OPS-011-03 - INV-DOM-PFM-OPS-003-04 preconditions: Unrevoked and revoked overrides span different time boundaries. steps: 'Resolve at the start, inside, at the end and outside each period.' expected: 'Only effective unrevoked decisions count, including the start and excluding the end.' negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-110 provenance: test source: >- services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in force at the instant it ends, so a replacement starting there leaves no overlap evidence_candidates: - >- services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in force at the instant it ends, so a replacement starting there leaves no overlap category: boundary binding_evidence: - >- services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in force at the instant it ends, so a replacement starting there leaves no overlap - id: ATS-PFM-OPS-011-04 title: Record withdrawal once level: api proves: - BR-CAP-PFM-OPS-011-04 - INV-DOM-PFM-OPS-003-03 preconditions: An existing override can be revoked. steps: Withdraw it and repeat the request. expected: The first records author and time and repetition conflicts. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses to withdraw the same override twice, with 409 evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses to withdraw the same override twice, with 409 category: transition binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses to withdraw the same override twice, with 409 - id: ATS-PFM-OPS-011-05 title: Preserve existing operational decisions level: api proves: - BR-CAP-PFM-OPS-011-05 preconditions: One workspace already has an application and another has none. steps: 'Grant, withhold and revoke for each relevant case.' expected: Only the first grant for missing application state initiates preparation. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-087 provenance: test source: >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#leaves the operational row exactly as it was, because the licence does not decide the state evidence_candidates: - >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#leaves the operational row exactly as it was, because the licence does not decide the state category: transition binding_evidence: - >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#leaves the operational row exactly as it was, because the licence does not decide the state - id: ATS-PFM-OPS-011-06 title: Describe the direction of licence decisions level: api proves: - BR-CAP-PFM-OPS-011-06 preconditions: 'Grant, withhold and corresponding revocations are available.' steps: Complete each decision flow. expected: Audit attempts retain reasons and the correct widening or narrowing direction. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-087 provenance: test source: >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#records the revocation of a withhold as a widening, because it gives the application back evidence_candidates: - >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#records the revocation of a withhold as a widening, because it gives the application back category: rule binding_evidence: - >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#records the revocation of a withhold as a widening, because it gives the application back - id: ATS-PFM-OPS-011-07 title: Request invalidation only after real decisions level: api proves: - BR-CAP-PFM-OPS-011-07 preconditions: A grant succeeds and its revocation is repeated. steps: 'Complete the grant and first revocation, then repeat withdrawal.' expected: Only completed decisions request flush jobs. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for none when the second revocation of the same override is refused, because nothing changed evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for none when the second revocation of the same override is refused, because nothing changed category: rule binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for none when the second revocation of the same override is refused, because nothing changed - id: ATS-PFM-OPS-011-08 title: Refuse unauthorized commercial changes level: api proves: - BR-CAP-PFM-OPS-011-08 preconditions: Read-only staff and a customer administrator lack HQ management authority. steps: Attempt override creation. expected: Neither creates a decision record. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#leaves the tenant with no override after that refusal evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#leaves the tenant with no override after that refusal category: permission binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#leaves the tenant with no override after that refusal - id: ATS-PFM-OPS-011-09 title: Preserve earlier choices during development seeding level: api proves: - BR-CAP-PFM-OPS-011-09 preconditions: Development workspaces include revoked decisions and a deleting workspace. steps: Run the seed twice. expected: Only undecided eligible pairs receive grants and repetition leaves prior choices intact. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-090 provenance: test source: >- services-platform:modules/licensing/tests/integration/services/enablement/seed-development-licences.revoked.integration.spec.js#writes no override on the second pass for the tenant whose grant was revoked evidence_candidates: - >- services-platform:modules/licensing/tests/integration/services/enablement/seed-development-licences.revoked.integration.spec.js#writes no override on the second pass for the tenant whose grant was revoked category: edge binding_evidence: - >- services-platform:modules/licensing/tests/integration/services/enablement/seed-development-licences.revoked.integration.spec.js#writes no override on the second pass for the tenant whose grant was revoked - id: ATS-PFM-OPS-011-10 title: Replace an export allowance without parallel active rows level: api proves: - BR-CAP-PFM-OPS-011-10 preconditions: A customer scope has an active allowance. steps: Replace it and attempt another direct unrevoked insert. expected: Replacement revokes the previous row and uniqueness refuses the competing active row. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/integration/services/persistence/data-export-entitlements.integration.spec.js#revokes the scope’s earlier row when it is set again, so one is in effect evidence_candidates: - >- services-platform:modules/licensing/tests/integration/services/persistence/data-export-entitlements.integration.spec.js#revokes the scope’s earlier row when it is set again, so one is in effect category: invariant - id: ATS-PFM-OPS-011-11 title: Hide and reverse a commercial withhold level: api proves: - AS-JNY-PFM-OPS-004-01 - AS-JNY-PFM-OPS-004-02 - AS-JNY-PFM-OPS-004-03 preconditions: An enabled licensed application can be withheld. steps: 'Withhold, inspect the customer response and revoke.' expected: >- The customer sees no internal decision and completed narrowing and widening flows request invalidation. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 - TST-PFM-OPS-087 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it - >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#records the revocation of a withhold as a widening, because it gives the application back - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for a flush when the override is revoked, so the licence stops being served within the request category: interaction binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it - >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#records the revocation of a withhold as a widening, because it gives the application back - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for a flush when the override is revoked, so the licence stops being served within the request - id: ATS-PFM-OPS-011-12 title: Review a withdrawn exception in staff history category: interaction level: api proves: - BR-CAP-PFM-OPS-011-04 - BR-CAP-PFM-OPS-013-02 exercises: - CAP-PFM-OPS-011 - CAP-PFM-OPS-013 preconditions: Staff have written a reasoned application exception. steps: Withdraw it and reopen the licensing panel’s historical decisions. expected: The same decision remains explainable with its original reason and revocation attribution. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses to withdraw the same override twice, with 409; services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#keeps a revoked override in the answer, because the trail is what the screen is for; CAP-PFM-OPS-013; WF-PFM-OPS-010; WF-PFM-OPS-011; WF-PFM-OPS-016; WF-PFM-OPS-017 - id: ATS-PFM-OPS-011-13 title: Restore contract coverage after withdrawing a withhold category: interaction level: api proves: - BR-CAP-PFM-OPS-011-04 - BR-CAP-PFM-OPS-014-02 exercises: - CAP-PFM-OPS-011 - CAP-PFM-OPS-014 preconditions: An enabled application has current contract coverage and an effective withhold. steps: 'Resolve access, withdraw the withhold, and resolve again.' expected: The commercial source of the restored result is the surviving contract. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses to withdraw the same override twice, with 409; services-platform:modules/licensing/services/availability/application-availability.ts:licenceStateOf; CAP-PFM-OPS-014; WF-PFM-OPS-010; WF-PFM-OPS-011; WF-PFM-OPS-016; WF-PFM-OPS-017 - id: ATS-PFM-OPS-011-14 title: Relate a change to its security history category: interaction level: api proves: - BR-CAP-PFM-OPS-011-06 exercises: - CAP-PFM-OPS-011 - CAP-PFM-SEC-011 preconditions: Staff make a reasoned change and later security-history insertion can fail. steps: Complete one change and repeat with failure injected after the decision commits. expected: >- The successful flow has attributable history; the later failure leaves the committed decision visible for investigation. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/services/enablement/grant-licence-override.ts:grantLicenceOverride; CAP-PFM-SEC-011; WF-PFM-OPS-010; WF-PFM-OPS-011; WF-PFM-OPS-016; WF-PFM-OPS-017 - id: ATS-PFM-OPS-011-15 title: Observe an access change across cache refresh category: interaction level: api proves: - BR-CAP-PFM-OPS-011-07 exercises: - CAP-PFM-OPS-011 - CAP-PFM-SEC-015 preconditions: An application decision changes while an older authorization answer remains cached. steps: 'Complete the change, observe the requested refresh job, then request a new access decision.' expected: >- The refresh request refers to the changed scope; access reflects the current decision after refresh or expiry. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for none when the second revocation of the same override is refused, because nothing changed; CAP-PFM-SEC-015; WF-PFM-OPS-010; WF-PFM-OPS-011; WF-PFM-OPS-016; WF-PFM-OPS-017 - id: ATS-PFM-OPS-011-16 title: Retain an exception when later history insertion fails category: failure level: api proves: - BR-CAP-PFM-OPS-011-06 preconditions: A valid staff exception commits before a history writer refuses its later insertion. steps: Inject the post-commit history failure and reread the exception independently. expected: >- The failed follow-up does not remove the commercial decision; the missing history remains an observable defect. negative: true data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/services/enablement/grant-licence-override.ts:grantLicenceOverride; FND-PFM-OPS-037 - id: ATS-PFM-OPS-011-17 title: Read override standing at start and end category: transition level: unit proves: - BR-CAP-PFM-OPS-011-03 - INV-DOM-PFM-OPS-003-04 preconditions: 'Separate decisions begin later, begin at the current instant, or end at that instant.' steps: Evaluate their effective standing using controlled instants. expected: The decisions change their effective standing at the checked boundary without a background update. negative: false data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: - TST-PFM-OPS-110 provenance: test source: >- services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#an override, read against an instant models: - STATE-PFM-OPS-004 transitions: - 1 - 2 evidence: - >- Pinned capability rules, object invariants, state transitions and workflows are reviewed for testing obligations. - >- Executable bindings refer only to existing suites; no module executable suite runs during this documentation job. coverage: rule: covered transition: covered validation: covered permission: covered edge: covered failure: covered boundary: covered concurrency: 'gap: FND-PFM-OPS-063' invariant: covered interaction: covered coverage_notes: concurrency: >- No controlled overlapping execution proves the capability’s read or write behavior while related state changes. related_capabilities: - CAP-PFM-OPS-013 - CAP-PFM-OPS-014 - CAP-PFM-SEC-011 - CAP-PFM-SEC-015 workflow_interactions: - WF-PFM-OPS-010 - WF-PFM-OPS-011 - WF-PFM-OPS-016 - WF-PFM-OPS-017 coverage_obligations: finding: FND-PFM-OPS-063 uncovered_must_prove: [] object_invariants_requiring_explicit_trace: - INV-DOM-PFM-OPS-003-05 - INV-DOM-PFM-OPS-003-06 - INV-DOM-PFM-OPS-003-07 - INV-DOM-PFM-OPS-003-08 - INV-DOM-PFM-OPS-003-09 - INV-DOM-PFM-OPS-003-10 - INV-DOM-PFM-OPS-003-11 related_scenarios: - capabilities: - CAP-PFM-OPS-011 - CAP-PFM-OPS-013 scenario: ATS-PFM-OPS-011-12 - capabilities: - CAP-PFM-OPS-011 - CAP-PFM-OPS-014 scenario: ATS-PFM-OPS-011-13 - capabilities: - CAP-PFM-OPS-011 - CAP-PFM-SEC-011 scenario: ATS-PFM-OPS-011-14 - capabilities: - CAP-PFM-OPS-011 - CAP-PFM-SEC-015 scenario: ATS-PFM-OPS-011-15 unbound_scenarios: - ATS-PFM-OPS-011-10 - ATS-PFM-OPS-011-12 - ATS-PFM-OPS-011-13 - ATS-PFM-OPS-011-14 - ATS-PFM-OPS-011-15 - ATS-PFM-OPS-011-16 transition_review: - model: STATE-PFM-OPS-004 transition: 3 from: in force to: revoked provenance: unknown source: FND-PFM-OPS-063 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-004 transition: 4 from: scheduled to: revoked provenance: unknown source: FND-PFM-OPS-063 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-004 transition: 5 from: ended to: revoked provenance: unknown source: FND-PFM-OPS-063 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. permission_review: - key: hq.licensing.manage where_checked: api provenance: unknown source: FND-PFM-OPS-063 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. gap_detail: >- Concurrent seed selection, competing withdrawals and post-commit follow-up failures need complete flow proof beyond ordinary sequential decisions. workflow_scenarios: WF-PFM-OPS-010: - ATS-PFM-OPS-011-12 - ATS-PFM-OPS-011-05 WF-PFM-OPS-011: - ATS-PFM-OPS-015-09 WF-PFM-OPS-016: - ATS-PFM-OPS-011-15 - ATS-PFM-OPS-014-12 --- # Make a reasoned exception to application licensing: Capability Test Specification ## Coverage The category map distinguishes authored scenarios from unresolved proof obligations. A bound scenario names an existing executable suite; its recorded result remains unrun. | Rule | Proof status | |---|---| | `BR-CAP-PFM-OPS-011-01` | `ATS-PFM-OPS-011-01` | | `BR-CAP-PFM-OPS-011-02` | `ATS-PFM-OPS-011-02` | | `BR-CAP-PFM-OPS-011-03` | `ATS-PFM-OPS-011-03`, `ATS-PFM-OPS-011-17` | | `BR-CAP-PFM-OPS-011-04` | `ATS-PFM-OPS-011-04`, `ATS-PFM-OPS-011-12`, `ATS-PFM-OPS-011-13` | | `BR-CAP-PFM-OPS-011-05` | `ATS-PFM-OPS-011-05` | | `BR-CAP-PFM-OPS-011-06` | `ATS-PFM-OPS-011-06`, `ATS-PFM-OPS-011-14`, `ATS-PFM-OPS-011-16` | | `BR-CAP-PFM-OPS-011-07` | `ATS-PFM-OPS-011-07`, `ATS-PFM-OPS-011-15` | | `BR-CAP-PFM-OPS-011-08` | `ATS-PFM-OPS-011-08` | | `BR-CAP-PFM-OPS-011-09` | `ATS-PFM-OPS-011-09` | | `BR-CAP-PFM-OPS-011-10` | `ATS-PFM-OPS-011-10` | ## Interactions With Related Capabilities Hide and reverse a commercial withhold. The customer sees no internal decision and completed narrowing and widening flows request invalidation. Review a withdrawn exception in staff history. The same decision remains explainable with its original reason and revocation attribution. Restore contract coverage after withdrawing a withhold. The commercial source of the restored result is the surviving contract. Relate a change to its security history. The successful flow has attributable history; the later failure leaves the committed decision visible for investigation. Observe an access change across cache refresh. The refresh request refers to the changed scope; access reflects the current decision after refresh or expiry. ## Evidence and Boundaries Pinned assertion sources support the listed executable bindings. Proposed cases retain the proof required beyond those boundaries. Structured obligations name incomplete object, transition and permission trace; row-level concurrency proof does not establish complete workflow serialization.