--- id: ATS-PFM-QRY-004 scope: CAP-PFM-QRY-004 product_area: platform module: queries revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f rhythm-v2-docs: 99376625d3e7ac26936413cfc31a88fba6562464 scenarios: - id: ATS-PFM-QRY-004-01 title: System-surface access alone grants no subject level: api proves: - BR-CAP-PFM-QRY-004-01 preconditions: One staff caller has only system-surface permission and another has the HQ reader policy. steps: List subjects as both and describe one as the limited caller. expected: The limited caller sees unauthorized entries and receives 403; the reader sees authorization. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers every dataset as unauthorized for a caller holding the surface key alone - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a caller holding the surface key but not this dataset’s key, with 403 - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers Rhythm HQ’s five datasets and nothing else, each one authorized for this caller - TST-PFM-QRY-235 provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers every dataset as unauthorized for a caller holding the surface key alone category: permission - id: ATS-PFM-QRY-004-02 title: Workspace subjects stay outside HQ level: api proves: - BR-CAP-PFM-QRY-004-02 - INV-DOM-PFM-QRY-001-12 preconditions: The caller has the HQ reader policy. steps: List system subjects and request a workspace dataset there. expected: The workspace subject is absent and returns 404 rather than 403. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#lists not one tenant dataset, Users and CRM’s belonging to a tenant and not to the system - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a tenant dataset as one that does not exist, with 404 and never 403 - TST-PFM-QRY-235 provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#lists not one tenant dataset, Users and CRM’s belonging to a tenant and not to the system category: invariant - id: ATS-PFM-QRY-004-03 title: HQ questions span customers level: api proves: - BR-CAP-PFM-QRY-004-03 preconditions: Several customers have workspace records. steps: Execute the customer and workspace system datasets. expected: The results include the customers and workspaces across the fixture. negative: false data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers every customer of every kind, read with no tenant anywhere - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers the tenants of every customer at once, which no tenant route could ever do - TST-PFM-QRY-235 provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers every customer of every kind, read with no tenant anywhere category: rule - id: ATS-PFM-QRY-004-04 title: Cross-scope models are rejected level: api proves: - BR-CAP-PFM-QRY-004-04 preconditions: A staff reader can query HQ datasets. steps: Submit a model joining a customer-workspace dataset to a system subject. expected: The model is refused. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a model that joins a tenant’s dataset to the system’s, the two having no tenant in common - TST-PFM-QRY-235 provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a model that joins a tenant’s dataset to the system’s, the two having no tenant in common category: validation - id: ATS-PFM-QRY-004-05 title: HQ descriptions omit personal workspace facets level: api proves: - BR-CAP-PFM-QRY-004-05 preconditions: A staff reader opens the workspace system dataset. steps: Describe it and execute its Recently Viewed scope. expected: 'Only all-record scope is offered with no custom fields, and personal scope is rejected.' negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#offers no custom field and no tenant’s label override, a system dataset having no tenant to define either - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#offers the `all` scope alone, a system dataset having no tenant in which anyone viewed a record - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses the recently_viewed scope: it answers what a person viewed in a tenant, and this dataset has none - TST-PFM-QRY-235 provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#offers no custom field and no tenant’s label override, a system dataset having no tenant to define either category: edge - id: ATS-PFM-QRY-004-06 title: Recipe libraries cannot cross surfaces level: api proves: - BR-CAP-PFM-QRY-004-06 preconditions: Both workspace and HQ recipes exist. steps: Read each recipe from the opposite surface. expected: Each cross-surface lookup returns 404. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a tenant’s recipe as one that does not exist, with 404 - >- services-platform:modules/queries/tests/e2e/llm-usage.e2e.spec.js#refuses a tenant caller one of them as a recipe that does not exist, with 404 - TST-PFM-QRY-235 - TST-PFM-QRY-228 provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a tenant’s recipe as one that does not exist, with 404 category: invariant binding_note: >- The cited suites contribute separate assertions. The complete combined example is not a single executable journey. - id: ATS-PFM-QRY-004-07 title: Customer usage records stay workspace-local level: api proves: - BR-CAP-PFM-QRY-004-07 preconditions: An organization has AI invocation records. steps: Request their dataset through HQ description and execution. expected: Both requests return 404. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/llm-usage.e2e.spec.js#keeps the organization’s requests out of a staff query on the system surface, with 404 - >- services-platform:modules/queries/tests/e2e/llm-usage.e2e.spec.js#reads not one tenant’s row from the system surface: the requests and the operations are unknown to it - TST-PFM-QRY-228 provenance: test source: >- services-platform:modules/queries/tests/e2e/llm-usage.e2e.spec.js#keeps the organization’s requests out of a staff query on the system surface, with 404 category: invariant - id: ATS-PFM-QRY-004-08 title: HQ vocabulary cannot become a workspace join category: interaction level: api exercises: - CAP-PFM-QRY-002 - CAP-PFM-QRY-004 proves: - BR-CAP-PFM-QRY-002-01 - BR-CAP-PFM-QRY-004-04 preconditions: A staff caller can investigate system customers and has a workspace contact grant. steps: Describe the system customer subject and submit a system question joined to workspace contacts. expected: System customers remain available and the workspace join is rejected. negative: true data_needs: >- Use an isolated workspace with the described source records, access grants and a surviving control workspace. bound_to: [] provenance: proposed source: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#confines a statement carrying no tenant predicate at all, so row-level security holds beneath the compiler - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a model that joins a tenant’s dataset to the system’s, the two having no tenant in common - id: ATS-PFM-QRY-004-09 title: Tailored workspace subjects remain outside HQ category: interaction level: api exercises: - CAP-PFM-QRY-004 - CAP-PFM-QRY-005 proves: - BR-CAP-PFM-QRY-004-02 - BR-CAP-PFM-QRY-005-05 preconditions: >- A published tailored dataset is assigned to one workspace and can be previewed in the validation workspace. steps: Preview it in the configured workspace and request it through the HQ system catalog. expected: Preview can return fixture rows; HQ treats the workspace subject as missing. negative: false data_needs: >- Use an isolated workspace with the described source records, access grants and a surviving control workspace. bound_to: [] provenance: proposed source: - >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a tenant dataset as one that does not exist, with 404 and never 403 - >- services-platform:modules/queries/tests/e2e/custom-tables.e2e.spec.js#refuses a preview of any other tenant, a customer’s rows needing a staff access grant there is no way to hold evidence: - 'Pinned reference: services-platform:modules/queries/tests/e2e/llm-usage.e2e.spec.js' - 'Pinned reference: services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js' coverage_notes: transition: >- This capability has no formal lifecycle of its own. Audience and definition changes remain rule, permission and concurrency proofs; related lifecycles are exercised through interaction scenarios. coverage: rule: covered transition: not-applicable validation: covered permission: covered edge: covered failure: 'gap: FND-PFM-QRY-054' boundary: 'gap: FND-PFM-QRY-054' concurrency: 'gap: FND-PFM-QRY-054' invariant: covered interaction: covered coverage_findings: - FND-PFM-QRY-054 transition_obligations: [] unproved_rules: [] --- # Answer operational questions across customers: Capability Test Specification ## Coverage | Rule | Scenario or Finding | |---|---| | `BR-CAP-PFM-QRY-004-01` | `ATS-PFM-QRY-004-01` | | `BR-CAP-PFM-QRY-004-02` | `ATS-PFM-QRY-004-02`, `ATS-PFM-QRY-004-09` | | `BR-CAP-PFM-QRY-004-03` | `ATS-PFM-QRY-004-03` | | `BR-CAP-PFM-QRY-004-04` | `ATS-PFM-QRY-004-04`, `ATS-PFM-QRY-004-08` | | `BR-CAP-PFM-QRY-004-05` | `ATS-PFM-QRY-004-05` | | `BR-CAP-PFM-QRY-004-06` | `ATS-PFM-QRY-004-06` | | `BR-CAP-PFM-QRY-004-07` | `ATS-PFM-QRY-004-07` | ## Interactions With Related Capabilities The combined examples change a source, its audience or its retained state before checking the dependent outcome. Unbound examples remain proposed, and the coverage finding retains design obligations that these examples do not establish. | Related Capability | Scenario | |---|---| | `CAP-PFM-QRY-002` | `ATS-PFM-QRY-004-08` | | `CAP-PFM-QRY-005` | `ATS-PFM-QRY-004-09` | ## Evidence and Binding Limits The source revisions pin the inspected assertions. A test binding identifies written assertions, and does not establish a successful run or approval of the expected behavior.