--- id: CAP-PFM-OPS-009 title: Review a person’s record-view history feature: FEAT-PFM-OPS-02 product_area: platform module: operations revision: 1 status: draft product_intent: confirmed implementation_evidence: partially-observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - >- services-platform:docs/audit-events.md#2026-10-12 — Final acceptance (scope: the person's raw view history and an administrator's read of it) purpose: Provide an authorized chronological account of the records a person has opened. outcomes: - A person can inspect their raw visit history under appropriate authority. - Administrative review remains distinct from individual history readership. concepts: - CON-PFM-OPS-002 actors: - ACT-PFM-002 - ACT-PFM-001 surfaces: - api preconditions: - The caller holds own-history authority or the separate permission needed for a colleague’s views. postconditions: - History inspection leaves activity records unchanged. permissions: - key: platform.record-views.read where_checked: api scope: tenant - key: platform.audit-events.read where_checked: api scope: tenant rules: - id: BR-CAP-PFM-OPS-009-01 proved_by: [ATS-PFM-OPS-009-01, TST-PFM-OPS-064] statement: >- Own-history reads require view-history authority, while a colleague’s history requires the separate administrator-tier audit permission. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/audit/tests/unit/aws/api/audit-permissions.spec.ts#declares reading another user’s audit events at the admin tier, which is what keeps it out of Read Only origin: 'services-platform:docs/audit-events.md#Permissions' - id: BR-CAP-PFM-OPS-009-02 proved_by: [ATS-PFM-OPS-008-12, ATS-PFM-OPS-009-02, ATS-PFM-OPS-009-07, ATS-PFM-OPS-010-11, TST-PFM-OPS-061] statement: >- Raw history retains one entry per visit in descending timestamp and identity order, including visits to deleted records without resolving their current contents. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#still holds the view after the contact is gone, because a trail is not a list of records origin: none - id: BR-CAP-PFM-OPS-009-03 proved_by: [ATS-PFM-OPS-009-03, TST-PFM-OPS-061] statement: History defaults to twenty-five rows and rejects requested sizes outside one through fifty. kind: validation enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a page larger than the maximum, naming it origin: none - id: BR-CAP-PFM-OPS-009-04 proved_by: [ATS-PFM-OPS-009-04, TST-PFM-OPS-059] statement: >- History pagination uses timestamp and event identity to traverse tied timestamps without gaps or repeats and rejects malformed cursor representations. kind: validation enforced_at: - api - service - database must_prove: true provenance: test source: >- services-platform:modules/audit/tests/integration/services/persistence/audit-events.queries.integration.spec.js#steps over the tie correctly when a page boundary falls inside it origin: none - id: BR-CAP-PFM-OPS-009-05 proved_by: [ATS-PFM-OPS-009-05, TST-PFM-OPS-061] statement: >- Filtering history by an unsupported registered record type is refused rather than returning an empty page. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a record type the registry does not hold, rather than answering an empty page origin: none - id: BR-CAP-PFM-OPS-009-06 proved_by: [ATS-PFM-OPS-009-06, TST-PFM-OPS-061] statement: History queries restrict results to the requested actor in the current workspace. kind: permission enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#answers nothing of another tenant’s history origin: none - id: BR-CAP-PFM-OPS-009-07 proved_by: [] statement: 'View-history reads exclude merge, intervention and other event types stored in the same trail.' kind: policy enforced_at: - service must_prove: false provenance: documented source: 'services-platform:docs/audit-events.md#The merge event' origin: none - id: BR-CAP-PFM-OPS-009-08 proved_by: [] statement: >- The accepted history scope provides API reads for a person and an administrator without a console history screen. kind: policy enforced_at: - console must_prove: false provenance: documented source: 'services-platform:docs/audit-events.md#2026-10-12 — Final acceptance (scope excludes a history UI)' origin: 'services-platform:docs/audit-events.md#2026-10-12 — Final acceptance' scenarios: - id: SC-CAP-PFM-OPS-009-01 given: A person has view history containing a visit to a removed record. when: The person pages through the authorized history. then: The raw visit remains present and pagination does not repeat or omit entries. provenance: inferred source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#pages the whole history in sevens with no gap and no repeat note: >- This illustrative example combines behavior established by the cited test and the capability’s implementation evidence; it is not an independently bound end-to-end proof. - id: SC-CAP-PFM-OPS-009-02 given: A reader lacks the colleague-history permission. when: The reader requests someone else’s views. then: The separate administrative route refuses the read. provenance: inferred source: >- services-platform:modules/audit/tests/unit/aws/api/audit-permissions.spec.ts#declares reading another user’s audit events at the admin tier, which is what keeps it out of Read Only note: >- This illustrative example combines behavior established by the cited test and the capability’s implementation evidence; it is not an independently bound end-to-end proof. edge_cases: [] constraints: [] depends_on: - CAP-PFM-OPS-008 related: - CAP-PFM-OPS-010 journeys: - JNY-PFM-OPS-003 open_questions: - OQ-PFM-OPS-001 evidence: - >- services-platform at ad3f6a6: modules/audit/aws/api/audit.routes.ts (listMyRecordViews, listUserRecordViews), audit-api-mapper.ts, services/record-views/view-history.ts, services/persistence/audit-events.ts:listViewHistory; view-history and audit-events.queries integration suites; audit-permissions and audit-api-mapper unit suites; aws/platform.service.ts RECORD_VIEWS_PERMISSIONS and AUDIT_EVENTS_PERMISSIONS. - >- Operations this capability covers: listMyRecordViews, listUserRecordViews. Permission keys: platform.record-views.read, platform.audit-events.read. - >- Examination: proposed acceptance matrices retain candidate test references; incomplete proof is recorded by FND-PFM-OPS-028. controls: [TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-OPS-02-01, FAS-PFM-OPS-02-02, FAS-PFM-OPS-02-03, FAS-PFM-OPS-02-04, FAS-PFM-OPS-02-05] suites: [TST-PFM-OPS-059, TST-PFM-OPS-061, TST-PFM-OPS-064] --- # Review a person’s record-view history ## Purpose Provide an authorized chronological account of the records a person has opened. ## How It Works A signed-in person requests their own workspace view history under its reading permission. An administrator uses a separate authority to request a named person’s history. The response contains visits, without resolving current record names or checking whether the record still exists. Paging continues through a stable timestamp-and-identity order. A supported record-type filter narrows the result. Invalid sizes and unsupported types produce explicit refusals. This read differs from Recent Items, which resolves records through the query layer. The accepted history capability currently has no dedicated console screen. ## Relationships Record owners establish the activity, and authorized queries use visits to support recent work without replacing raw history.