--- source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f finding_evidence: - finding: FND-PFM-SEC-001 source: 'specs/PRODUCT-AREAS.md (MOD-PFM-SEC row); react-console tree at baf6dae (app/(console)/hq, app/(console)/console/[tenantId]/me, acceptance/platform-attention/README.md); services-platform docs/security, docs/tenants, docs/hq' - finding: FND-PFM-SEC-002 source: 'services-platform:docs/milestones/README.md (no security, tenants or customers section); docs/standards/milestone-development-and-acceptance.md#1. Milestones' - finding: FND-PFM-SEC-003 source: 'services-platform:docs/hq/rhythm-hq-plan.md#D8; modules/customers/services/persistence/customers.ts:deleteCustomer; modules/customers/aws/api/customers.routes.ts:deleteCustomer' - finding: FND-PFM-SEC-004 source: 'services-platform:docs/standards/record-write-contracts.md#D-05; docs/standards/record-write-contracts/compliance-by-service.md (services-platform W1, W2); modules/customers/aws/api/customer-api-mapper.ts:mapReplaceCustomerRequest; modules/customers/aws/api/customers.schemas.ts:hqCustomerPatchRequestSchema' - finding: FND-PFM-SEC-005 source: 'services-platform:aws/platform.service.ts (CUSTOMER_RECORD_PERMISSIONS, TENANT_RECORD_PERMISSIONS, USERS_PERMISSIONS, HQ_STAFF_PERMISSIONS, HQ_ROLES_PERMISSIONS, APPLICATION_PERMISSIONS); route declarations in modules/security, tenants, customers aws/api' - finding: FND-PFM-SEC-006 source: 'services-platform:modules/security/aws/api/invitations.routes.ts (resendInvitation, revokeUser, suspendUser, reinstateUser, activateUser); definitions.routes.ts:getPermissionCatalog; docs/security/security-administration.md#Phase 23' - finding: FND-PFM-SEC-007 source: 'services-platform:docs/hq/rhythm-hq-plan.md#K6, #D3, #D4; docs/tenants/tenant-identity.md; docs/tenants/tenant-lifecycle-plan.md#5.2 Who may do what' - finding: FND-PFM-SEC-008 source: 'services-platform:docs/milestones/PLAT-M13-eligibility-roles-and-permissions.md; modules/security/services/derived-assignments' - finding: FND-PFM-SEC-009 source: 'services-platform:docs/security/grant-slice-growth.md#Decision 3; modules/tenants/services/access/tenant-availability.ts; modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off' - finding: FND-PFM-SEC-010 source: 'services-platform:docs/security/console-authentication.md (Status line; Acceptance checkpoints); docs/security/security-administration.md (opening paragraph); docs/proposals/security-authorization.md (Status line)' - finding: FND-PFM-SEC-011 source: 'services-platform:docs/standards/record-write-contracts/compliance-by-service.md (services-platform W7); modules/tenants/services/deletion/operator-recovery.ts' - finding: FND-PFM-SEC-012 source: 'services-platform:docs/security/authorizer-cache-flush.md; docs/security/security-administration.md#2. Capability checklist (U6); #14 (2026-10-12/13 known bound)' - finding: FND-PFM-SEC-013 source: 'services-platform:modules/security/aws/api/portal-identity.routes.ts (header); docs/tenants/tenant-identity.md#The security context of the tenant a console URL names (EX-TEN-003)' - finding: FND-PFM-SEC-014 source: 'services-platform:docs/security/service-calls.md#4 (No console screen calls these yet); docs/tenants/console-contract.md; react-console app/(console)/hq tree' - finding: FND-PFM-SEC-015 source: 'services-platform:docs/hq/rhythm-hq-plan.md#H2; docs/tenants/tenant-lifecycle-plan.md#5.2; modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives Support Representative the HQ reader and the deletion hold, at platform scope, and no customer app' - finding: FND-PFM-SEC-016 source: 'services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#lets a sandbox tenant go live, the data-import check being recorded as debt' - finding: FND-PFM-SEC-017 source: 'services-platform:docs/hq/rhythm-hq-plan.md#K2, #D9, #K7' - finding: FND-PFM-SEC-018 source: 'services-platform:docs/debt/portal-sign-in-contract-gaps.md; modules/security/aws/api/portal-identity.routes.ts (header)' - finding: FND-PFM-SEC-019 source: 'services-platform:modules/security/services/invitations/invite-staff.ts; modules/security/aws/api/hq-staff.routes.ts; modules/security/tests (no suite names inviteHqStaff)' - finding: FND-PFM-SEC-020 source: 'services-platform:docs/security/console-authentication.md#(c) and (d); docs/security/authorizer-cache-flush.md' - finding: FND-PFM-SEC-021 source: 'services-platform:modules/customers/aws/api/customers.schemas.ts:hqCustomerPatchRequestSchema; aws/platform.service.ts (TENANTS_PERMISSIONS ManageCommercialLink)' - finding: FND-PFM-SEC-022 source: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#13 (D3, D6 to D9); #Acceptance checkpoints (2026-10-10, Decisions)' - finding: FND-PFM-SEC-023 source: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#2.2 One record, two axes; modules/tenants/db/tenants.table.ts:TENANT_LIFECYCLE_STATES' - finding: FND-PFM-SEC-024 source: 'specs/PRODUCT-AREAS.md (MOD-PFM-TNL, MOD-PFM-OPS rows); services-platform aws/platform.service.ts (HQ_DATA_RUNS_PERMISSIONS)' - finding: FND-PFM-SEC-025 source: 'services-platform:docs/security/security-administration.md#3.3 Lifecycle of a built-in (Caching); docs/tenants/tenant-lifecycle-plan.md#5.6; docs/security/authorizer-cache-flush.md' - finding: FND-PFM-SEC-026 source: 'react-console:acceptance/platform-attention/journeys/security/RA-ACC-0200.json, RA-ACC-0201.json, RA-ACC-0202.json' - finding: FND-PFM-SEC-027 source: 'services-platform:docs/security/invitation-lifecycle.md#Backend implementation (landed) (State machine)' - finding: FND-PFM-SEC-028 source: briefs/planning/platform-security.brief.md; briefs/planning-examination/platform-security.brief.md - finding: FND-PFM-SEC-029 source: 'services-platform:docs/security/portal-contact-claim.md#When a change is seen; services-platform:docs/security/authorizer-cache-flush.md#What the system does today' - finding: FND-PFM-SEC-030 source: 'services-platform:docs/security/portal-contact-claim.md#What it is; services-platform:docs/milestones/PLAT-M13-eligibility-roles-and-permissions.md' - finding: FND-PFM-SEC-031 source: specs/CONVENTIONS.md#6. Document Form - finding: FND-PFM-SEC-032 source: 'services-platform:modules/customers/tests/integration/services/persistence/customers.integration.spec.js#clears a property the replacement omits; services-platform:modules/customers/db/customers.table.ts:customerWire' - finding: FND-PFM-SEC-033 source: 'services-platform:modules/customers/aws/api/customers.routes.ts:customersRoutes' - finding: FND-PFM-SEC-035 source: 'services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#clears the fields the replacement omits; services-platform:modules/tenants/db/tenants.table.ts:tenantWire; services-platform:modules/tenants/services/persistence/tenants.ts:updateTenant' - finding: FND-PFM-SEC-034 source: specs/platform/security/MODULE.md; specs/CONVENTIONS.md#5.0a Key Concept - finding: FND-PFM-SEC-036 source: 'services-platform:modules/security/aws/resources/security-pool-account-removals.sqs.ts:createPoolAccountRemovalQueue; services-platform:modules/security/aws/resources/security-derived-assignment-reconciles.sqs.ts:createDerivedAssignmentReconcileQueue; services-platform:modules/security/aws/logic/security-pool-account-removals.lambda.ts:createPoolAccountRemovalFunctions; services-platform:modules/security/aws/logic/security-derived-assignments.lambda.ts:createDerivedAssignmentFunctions' - finding: FND-PFM-SEC-037 source: 'services-platform:modules/security/services/invitations/suspend-user.ts (header, steps 2 and 3); modules/security/services/invitations/revoke-user.ts (header); modules/security/services/dispatch/remove-pool-account.ts' - finding: FND-PFM-SEC-038 source: 'react-console at baf6dae: components/console/hq (no caller of /hq/access_requests, /hq/tenants/{id}/loading, /hq/tenants/{id}/reset or /hq/tenants/{id}/activation); services-platform:modules/security/aws/api/hq-access-requests.routes.ts; modules/tenants/aws/api/hq-tenant-loading.routes.ts' - finding: FND-PFM-SEC-039 source: 'services-platform:modules/security/db/identity-pools.table.ts:POOL_STATUSES; modules/security/services/persistence/identity-pools.ts (writes only provisioning and active)' - finding: FND-PFM-SEC-040 source: 'services-platform:modules/tenants/tenants-notifications.ts; modules/security, modules/tenants, modules/customers (no business-event publisher); docs/business-events.md' - finding: FND-PFM-SEC-041 source: specs/CONVENTIONS.md#9.8 Inference Operation (IOP); specs/platform/security/MODULE.md - finding: FND-PFM-SEC-042 source: 'services-platform:modules/tenants/services/deletion/tenant-deletion-schedule-workflow.ts (header, "Not retryable"); modules/tenants/services/deletion/operator-recovery.ts; modules/tenants/aws/logic/tenant-deletion-notice.alarm.ts' - finding: FND-PFM-SEC-043 source: 'services-platform:modules/tenants/services/lifecycle/lifecycle-transitions.ts:SUCCESSORS (loading to deletion_pending); modules/tenants/services/deletion/request-deletion.ts:REQUESTABLE_TENANT_LIFECYCLE_STATES; modules/tenants/db/tenants.table.ts (tenants_loading_status_check)' - finding: FND-PFM-SEC-044 source: 'services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant' - finding: FND-PFM-SEC-045 source: 'services-platform:modules/security/services/provisioning/provision-user.ts:sendInvitation; modules/security/services/persistence/invitations.ts:issueInvitationToken' - finding: FND-PFM-SEC-046 source: 'services-platform:modules/security/aws/resources/security-pool-account-removals.sqs.ts:createPoolAccountRemovalQueue; modules/security/aws/logic/security-pool-account-removals.lambda.ts:createPoolAccountRemovalFunctions; modules/security/security.settings.ts' - finding: FND-PFM-SEC-047 source: 'services-platform:modules/security/authorizer/registry/publish.ts:activate; modules/security/authorizer/ports.postgres.ts:commitCatalog; modules/security/authorizer/registry/registry-table.ts' - finding: FND-PFM-SEC-048 source: 'react-console:lib/hq/permissions.ts:staffActionPermissions; components/console/hq/staff/hq-roles.tsx:HqRoles; services-platform:modules/security/aws/api/hq-staff.routes.ts' - finding: FND-PFM-SEC-049 source: 'react-console:app/(console)/console/[tenantId]/security/page.tsx:SecurityPage; components/console/nav-config.ts:areaHome' - finding: FND-PFM-SEC-050 source: 'services-platform:modules/tenants/services/deletion/tenant-purge-operations.ts:finalizeOperation; modules/tenants/services/deletion/tenant-purge-failure.ts:applyTenantPurgeFailure; modules/tenants/services/deletion/operator-recovery.ts:retryTenantPurge' - finding: FND-PFM-SEC-051 source: 'services-platform:modules/tenants/services/deletion/notices/send-notices.ts:sendOneNotice' - finding: FND-PFM-SEC-052 source: 'services-platform:modules/security/services/invitations/accept-invitation.ts:acceptInvitation' - finding: FND-PFM-SEC-053 source: 'services-platform:modules/security/services/portal/contact-match.ts:getContactMatch, declineContactMatch; modules/security/services/portal/contact-directory.ts' - finding: FND-PFM-SEC-054 source: 'services-platform:modules/security/services/persistence/users.ts:linkPortalMemberContact; modules/security/db/users.table.ts:users_contact_idx; modules/security/services/persistence/portal-contact-challenges.ts:startPortalContactChallenge; modules/security/db/portal-contact-challenges.table.ts' - finding: FND-PFM-SEC-055 source: 'services-platform:modules/security/services/staff-access/request-tenant-access.ts:requestTenantAccess; modules/security/services/persistence/staff-access-grants.ts:findOpenStaffAccessRequest, requestStaffAccessGrant; modules/security/db/staff-access-grants.table.ts' - finding: FND-PFM-SEC-056 source: 'services-platform:modules/security/services/persistence/audit-events.ts:recordSecurityAuditEvent; modules/security/db/security-audit-events.table.ts; modules/security/services/audit/refused-attempts.ts:auditedAttempt; modules/tenants/services/lifecycle/participants.ts' - finding: FND-PFM-SEC-057 source: 'services-platform:docs/jobs.md; modules/tenants/services/provisioning/submit-tenant-provisioning.ts; modules/tenants/services/deletion/request-deletion.ts; package-lock.json' affected_rules: - finding: FND-PFM-SEC-001 ids: - MOD-PFM-SEC - finding: FND-PFM-SEC-002 ids: - MOD-PFM-SEC - finding: FND-PFM-SEC-003 ids: - CAP-PFM-SEC-001 - BR-CAP-PFM-SEC-001-13 - finding: FND-PFM-SEC-004 ids: - CAP-PFM-SEC-001 - CAP-PFM-SEC-002 - CAP-PFM-SEC-012 - BR-CAP-PFM-SEC-001-06 - BR-CAP-PFM-SEC-001-10 - BR-CAP-PFM-SEC-002-08 - BR-CAP-PFM-SEC-012-12 - finding: FND-PFM-SEC-005 ids: - CAP-PFM-SEC-001 - CAP-PFM-SEC-002 - CAP-PFM-SEC-009 - CAP-PFM-SEC-016 - BR-CAP-PFM-SEC-016-11 - finding: FND-PFM-SEC-006 ids: - CAP-PFM-SEC-008 - CAP-PFM-SEC-009 - CAP-PFM-SEC-012 - finding: FND-PFM-SEC-007 ids: - CAP-PFM-SEC-003 - CAP-PFM-SEC-004 - BR-CAP-PFM-SEC-004-02 - BR-CAP-PFM-SEC-003-14 - BR-CAP-PFM-SEC-001-02 - finding: FND-PFM-SEC-008 ids: - CAP-PFM-SEC-014 - BR-CAP-PFM-SEC-014-13 - BR-CAP-PFM-SEC-014-07 - BR-CAP-PFM-SEC-014-08 - BR-CAP-PFM-SEC-014-12 - finding: FND-PFM-SEC-009 ids: - CAP-PFM-SEC-002 - BR-CAP-PFM-SEC-002-09 - finding: FND-PFM-SEC-010 ids: - CAP-PFM-SEC-005 - CAP-PFM-SEC-006 - CAP-PFM-SEC-012 - finding: FND-PFM-SEC-011 ids: - CAP-PFM-SEC-004 - BR-CAP-PFM-SEC-004-13 - finding: FND-PFM-SEC-012 ids: - CAP-PFM-SEC-015 - CAP-PFM-SEC-009 - CAP-PFM-SEC-017 - BR-CAP-PFM-SEC-015-11 - BR-CAP-PFM-SEC-009-04 - BR-CAP-PFM-SEC-017-10 - finding: FND-PFM-SEC-013 ids: - CAP-PFM-SEC-019 - CAP-PFM-SEC-007 - BR-CAP-PFM-SEC-019-10 - BR-CAP-PFM-SEC-007-06 - finding: FND-PFM-SEC-014 ids: - CAP-PFM-SEC-018 - CAP-PFM-SEC-004 - BR-CAP-PFM-SEC-018-07 - finding: FND-PFM-SEC-015 ids: - CAP-PFM-SEC-013 - CAP-PFM-SEC-016 - CAP-PFM-SEC-004 - BR-CAP-PFM-SEC-013-07 - BR-CAP-PFM-SEC-004-01 - finding: FND-PFM-SEC-016 ids: - CAP-PFM-SEC-002 - CAP-PFM-SEC-003 - BR-CAP-PFM-SEC-002-02 - BR-CAP-PFM-SEC-003-15 - finding: FND-PFM-SEC-017 ids: - CAP-PFM-SEC-017 - CAP-PFM-SEC-006 - CAP-PFM-SEC-016 - BR-CAP-PFM-SEC-017-07 - BR-CAP-PFM-SEC-006-12 - BR-CAP-PFM-SEC-016-10 - finding: FND-PFM-SEC-018 ids: - CAP-PFM-SEC-019 - BR-CAP-PFM-SEC-019-11 - finding: FND-PFM-SEC-019 ids: - CAP-PFM-SEC-016 - BR-CAP-PFM-SEC-016-03 - BR-CAP-PFM-SEC-016-05 - finding: FND-PFM-SEC-020 ids: - CAP-PFM-SEC-005 - CAP-PFM-SEC-015 - BR-CAP-PFM-SEC-005-08 - BR-CAP-PFM-SEC-015-11 - finding: FND-PFM-SEC-021 ids: - CAP-PFM-SEC-001 - CAP-PFM-SEC-002 - BR-CAP-PFM-SEC-001-10 - BR-CAP-PFM-SEC-002-07 - finding: FND-PFM-SEC-022 ids: - CAP-PFM-SEC-004 - CAP-PFM-SEC-011 - BR-CAP-PFM-SEC-004-04 - BR-CAP-PFM-SEC-011-09 - finding: FND-PFM-SEC-023 ids: - CAP-PFM-SEC-002 - CAP-PFM-SEC-003 - BR-CAP-PFM-SEC-002-03 - BR-CAP-PFM-SEC-003-13 - finding: FND-PFM-SEC-024 ids: - CAP-PFM-SEC-003 - CAP-PFM-SEC-004 - finding: FND-PFM-SEC-025 ids: - CAP-PFM-SEC-015 - BR-CAP-PFM-SEC-015-11 - finding: FND-PFM-SEC-026 ids: - MOD-PFM-SEC - finding: FND-PFM-SEC-027 ids: - CAP-PFM-SEC-009 - finding: FND-PFM-SEC-028 ids: - MOD-PFM-SEC - finding: FND-PFM-SEC-029 ids: - CAP-PFM-SEC-009 - CAP-PFM-SEC-010 - CAP-PFM-SEC-012 - CAP-PFM-SEC-017 - CAP-PFM-SEC-020 - finding: FND-PFM-SEC-030 ids: - CAP-PFM-SEC-014 - CAP-PFM-SEC-020 - finding: FND-PFM-SEC-031 ids: - MOD-PFM-SEC - finding: FND-PFM-SEC-032 ids: - CAP-PFM-SEC-001 - ATS-PFM-SEC-001 - finding: FND-PFM-SEC-033 ids: - CAP-PFM-SEC-001 - CAP-PFM-SEC-017 - finding: FND-PFM-SEC-035 ids: - CAP-PFM-SEC-002 - ATS-PFM-SEC-002 - finding: FND-PFM-SEC-034 ids: - MOD-PFM-SEC - CON-PFM-SEC-004 - CON-PFM-SEC-005 - CON-PFM-SEC-006 - finding: FND-PFM-SEC-036 ids: - CAP-PFM-SEC-009 - CAP-PFM-SEC-014 - MOD-PFM-SEC - finding: FND-PFM-SEC-037 ids: - CAP-PFM-SEC-009 - BR-CAP-PFM-SEC-009-04 - BR-CAP-PFM-SEC-009-05 - WF-PFM-SEC-007 - finding: FND-PFM-SEC-038 ids: - CAP-PFM-SEC-003 - CAP-PFM-SEC-017 - SCR-PFM-SEC-027 - finding: FND-PFM-SEC-039 ids: - STATE-PFM-SEC-010 - CAP-PFM-SEC-019 - finding: FND-PFM-SEC-040 ids: - SVC-PFM-SEC-security - SVC-PFM-SEC-tenants - SVC-PFM-SEC-customers - finding: FND-PFM-SEC-041 ids: - MOD-PFM-SEC - finding: FND-PFM-SEC-042 ids: - WF-PFM-SEC-003 - CAP-PFM-SEC-004 - BR-CAP-PFM-SEC-004-10 - finding: FND-PFM-SEC-043 ids: - STATE-PFM-SEC-001 - CAP-PFM-SEC-004 - BR-CAP-PFM-SEC-004-02 - finding: FND-PFM-SEC-044 ids: - STATE-PFM-SEC-001 - WF-PFM-SEC-002 - DOM-PFM-SEC-002 - finding: FND-PFM-SEC-045 ids: - STATE-PFM-SEC-005 - WF-PFM-SEC-005 - finding: FND-PFM-SEC-046 ids: - STATE-PFM-SEC-004 - WF-PFM-SEC-007 - finding: FND-PFM-SEC-047 ids: - WF-PFM-SEC-012 - SVC-PFM-SEC-security - finding: FND-PFM-SEC-048 ids: - SCR-PFM-SEC-029 - SCR-PFM-SEC-030 - SCR-PFM-SEC-031 - CAP-PFM-SEC-016 - finding: FND-PFM-SEC-049 ids: - SCR-PFM-SEC-001 - finding: FND-PFM-SEC-050 ids: - WF-PFM-SEC-004 - STATE-PFM-SEC-003 - SVC-PFM-SEC-tenants - finding: FND-PFM-SEC-051 ids: - WF-PFM-SEC-003 - finding: FND-PFM-SEC-052 ids: - WF-PFM-SEC-006 - STATE-PFM-SEC-005 - finding: FND-PFM-SEC-053 ids: - WF-PFM-SEC-015 - finding: FND-PFM-SEC-054 ids: - DOM-PFM-SEC-003 - STATE-PFM-SEC-011 - WF-PFM-SEC-015 - finding: FND-PFM-SEC-055 ids: - DOM-PFM-SEC-003 - STATE-PFM-SEC-007 - WF-PFM-SEC-011 - finding: FND-PFM-SEC-056 ids: - DOM-PFM-SEC-003 - ADR-PFM-SEC-014 - finding: FND-PFM-SEC-057 ids: - WF-PFM-SEC-001 - WF-PFM-SEC-003 - ADR-PFM-SEC-005 testing_coverage_gaps: - id: FND-PFM-SEC-058 cap: CAP-PFM-SEC-001 categories: &ref_0 - rule - edge - failure missing_rules: - BR-CAP-PFM-SEC-001-13 unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md - specs/platform/security/design/workflows/WF-PFM-SEC-001-provision-a-workspace.md - specs/platform/security/design/workflows/WF-PFM-SEC-011-grant-and-end-staff-entry-to-a-customer-workspace.md statement: 'Dedicated rule, edge, failure proof remains incomplete for establish and administer a customer.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-001-07 - ATS-PFM-SEC-001-12 - ATS-PFM-SEC-001-13 - ATS-PFM-SEC-001-14 missing_categories: *ref_0 permissions_to_complete: - key: hq.customers.create where_checked: api scope: global - key: hq.customers.read where_checked: api scope: global - key: hq.customers.update where_checked: api scope: global - key: hq.customers.delete where_checked: api scope: global - key: platform.customers.read where_checked: api scope: record - key: platform.customers.update where_checked: api scope: record operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-059 cap: CAP-PFM-SEC-002 categories: &ref_1 - failure missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md - specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md statement: Dedicated failure proof remains incomplete for maintain workspace information and operating status. kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-002-08 - ATS-PFM-SEC-002-15 - ATS-PFM-SEC-002-16 - ATS-PFM-SEC-002-17 - ATS-PFM-SEC-002-18 - ATS-PFM-SEC-002-19 - ATS-PFM-SEC-002-20 - ATS-PFM-SEC-002-21 - ATS-PFM-SEC-002-22 - ATS-PFM-SEC-002-23 - ATS-PFM-SEC-002-24 missing_categories: *ref_1 permissions_to_complete: - key: platform.tenants.read where_checked: api scope: record - key: platform.tenants.update where_checked: api scope: record - key: platform.tenants.bulk where_checked: api scope: tenant - key: platform.tenants.manage-status where_checked: api scope: global - key: platform.tenants.manage-commercial-link where_checked: api scope: global - key: hq.tenants.read where_checked: api scope: global - key: hq.tenants.update where_checked: api scope: global operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-060 cap: CAP-PFM-SEC-003 categories: &ref_2 - invariant missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-003-provision-a-workspace-and-bring-it-into-service.md - specs/platform/security/design/workflows/WF-PFM-SEC-001-provision-a-workspace.md - specs/platform/security/design/workflows/WF-PFM-SEC-002-open-reset-and-activate-an-initial-load.md - specs/platform/security/design/workflows/WF-PFM-SEC-005-invite-a-person-and-deliver-the-invitation.md statement: Dedicated invariant proof remains incomplete for prepare a workspace for customer use. kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-003-15 - ATS-PFM-SEC-003-16 - ATS-PFM-SEC-003-17 - ATS-PFM-SEC-003-18 - ATS-PFM-SEC-003-19 - ATS-PFM-SEC-003-20 - ATS-PFM-SEC-003-21 - ATS-PFM-SEC-003-22 - ATS-PFM-SEC-003-23 - ATS-PFM-SEC-003-24 missing_categories: *ref_2 permissions_to_complete: - key: hq.tenants.provision where_checked: api scope: global - key: hq.tenants.read where_checked: api scope: global - key: hq.tenants.activate where_checked: api scope: global - key: hq.data-runs.manage where_checked: api scope: global operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-061 cap: CAP-PFM-SEC-004 categories: &ref_3 - rule - transition - edge missing_rules: - BR-CAP-PFM-SEC-004-13 unreachable: - state: STATE-PFM-SEC-001 index: 6 source: FND-PFM-SEC-043 source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-004-retire-a-workspace-through-a-deliberate-reversible-deletion.md - specs/platform/security/design/workflows/WF-PFM-SEC-003-watch-a-retirement-request-through-its-waiting-period.md - specs/platform/security/design/workflows/WF-PFM-SEC-004-purge-a-retired-workspace.md statement: 'Dedicated rule, transition, edge proof remains incomplete for manage a workspace retirement request.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-004-12 - ATS-PFM-SEC-004-13 - ATS-PFM-SEC-004-14 - ATS-PFM-SEC-004-15 - ATS-PFM-SEC-004-16 - ATS-PFM-SEC-004-17 - ATS-PFM-SEC-004-18 - ATS-PFM-SEC-004-19 - ATS-PFM-SEC-004-20 - ATS-PFM-SEC-004-21 - ATS-PFM-SEC-004-22 - ATS-PFM-SEC-004-23 - ATS-PFM-SEC-004-24 - ATS-PFM-SEC-004-25 - ATS-PFM-SEC-004-26 missing_categories: *ref_3 permissions_to_complete: - key: platform.tenants.deletion-request where_checked: api scope: global - key: platform.tenants.deletion-hold where_checked: api scope: global - key: platform.tenants.deletion-cancel where_checked: api scope: global - key: platform.tenants.deletion-read where_checked: api scope: global missing_invariants: - INV-DOM-PFM-SEC-002-10 operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-062 cap: CAP-PFM-SEC-005 categories: &ref_4 - failure - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-005-accept-an-invitation-and-set-up-an-account.md - specs/platform/security/design/workflows/WF-PFM-SEC-006-accept-an-invitation.md statement: 'Dedicated failure, concurrency proof remains incomplete for join through an invitation.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-005-08 - ATS-PFM-SEC-005-14 - ATS-PFM-SEC-005-15 - ATS-PFM-SEC-005-16 - ATS-PFM-SEC-005-17 - ATS-PFM-SEC-005-18 - ATS-PFM-SEC-005-19 - ATS-PFM-SEC-005-20 missing_categories: *ref_4 permissions_to_complete: [] operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-063 cap: CAP-PFM-SEC-006 categories: &ref_5 - rule - edge - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-006-sign-in-stay-signed-in-and-recover-a-password.md - specs/platform/security/design/workflows/WF-PFM-SEC-016-sign-in-to-the-console-and-keep-the-session.md statement: 'Dedicated rule, edge, concurrency proof remains incomplete for use and recover a console sign-in.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-006-11 - ATS-PFM-SEC-006-12 - ATS-PFM-SEC-006-13 missing_categories: *ref_5 permissions_to_complete: - key: platform.users.change-password where_checked: api scope: record - key: platform.users.manage-passwords where_checked: api scope: tenant - key: platform.users.read where_checked: api scope: record operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-064 cap: CAP-PFM-SEC-007 categories: &ref_6 - concurrency - invariant missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-007-know-what-i-may-do-in-a-workspace.md - specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md - specs/platform/security/design/workflows/WF-PFM-SEC-016-sign-in-to-the-console-and-keep-the-session.md statement: 'Dedicated concurrency, invariant proof remains incomplete for understand available workspace access.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-007-14 - ATS-PFM-SEC-007-15 - ATS-PFM-SEC-007-16 missing_categories: *ref_6 permissions_to_complete: - key: platform.security-self.read where_checked: api scope: record - key: platform.application.access where_checked: console scope: tenant operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-065 cap: CAP-PFM-SEC-008 categories: &ref_7 - rule - edge - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-008-invite-people-and-follow-their-invitations.md - specs/platform/security/design/workflows/WF-PFM-SEC-005-invite-a-person-and-deliver-the-invitation.md - specs/platform/security/design/workflows/WF-PFM-SEC-007-suspend-reinstate-revoke-or-delete-a-membership.md statement: 'Dedicated rule, edge, concurrency proof remains incomplete for offer and manage an invitation.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-008-12 - ATS-PFM-SEC-008-13 - ATS-PFM-SEC-008-14 - ATS-PFM-SEC-008-15 - ATS-PFM-SEC-008-16 - ATS-PFM-SEC-008-17 - ATS-PFM-SEC-008-18 - ATS-PFM-SEC-008-19 - ATS-PFM-SEC-008-20 - ATS-PFM-SEC-008-21 - ATS-PFM-SEC-008-22 missing_categories: *ref_7 permissions_to_complete: - key: platform.security-access.manage where_checked: api scope: tenant - key: platform.users.read where_checked: api scope: tenant operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-066 cap: CAP-PFM-SEC-009 categories: &ref_8 - rule - permission - edge missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md - specs/platform/security/design/workflows/WF-PFM-SEC-007-suspend-reinstate-revoke-or-delete-a-membership.md - specs/platform/security/design/workflows/WF-PFM-SEC-008-flush-the-gateway-s-cached-decisions.md statement: 'Dedicated rule, permission, edge proof remains incomplete for maintain console memberships.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-009-12 - ATS-PFM-SEC-009-13 - ATS-PFM-SEC-009-14 - ATS-PFM-SEC-009-15 - ATS-PFM-SEC-009-16 - ATS-PFM-SEC-009-17 - ATS-PFM-SEC-009-18 - ATS-PFM-SEC-009-19 - ATS-PFM-SEC-009-20 missing_categories: *ref_8 permissions_to_complete: - key: platform.users.read where_checked: api scope: tenant - key: platform.security-access.manage where_checked: api scope: tenant - key: platform.users.create where_checked: api scope: tenant - key: platform.users.update where_checked: api scope: tenant - key: platform.users.delete where_checked: api scope: tenant - key: platform.users.bulk where_checked: api scope: tenant - key: platform.users.manage-identities where_checked: api scope: tenant operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-067 cap: CAP-PFM-SEC-010 categories: &ref_9 - validation - edge - failure missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md - specs/platform/security/design/workflows/WF-PFM-SEC-008-flush-the-gateway-s-cached-decisions.md statement: 'Dedicated validation, edge, failure proof remains incomplete for assign roles within a controlled scope.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-010-14 - ATS-PFM-SEC-010-15 - ATS-PFM-SEC-010-16 - ATS-PFM-SEC-010-17 - ATS-PFM-SEC-010-18 - ATS-PFM-SEC-010-19 - ATS-PFM-SEC-010-20 - ATS-PFM-SEC-010-21 - ATS-PFM-SEC-010-22 missing_categories: *ref_9 permissions_to_complete: - key: platform.security-access.manage where_checked: api scope: tenant - key: platform.security-access.explain where_checked: api scope: tenant - key: platform.users.read where_checked: api scope: tenant operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-068 cap: CAP-PFM-SEC-011 categories: &ref_10 - validation - edge - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-011-review-who-changed-access-and-what-was-refused.md statement: 'Dedicated validation, edge, concurrency proof remains incomplete for review security changes and refused attempts.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-011-07 - ATS-PFM-SEC-011-08 - ATS-PFM-SEC-011-09 - ATS-PFM-SEC-011-10 missing_categories: *ref_10 permissions_to_complete: - key: platform.security-access.explain where_checked: api scope: tenant partial_invariants: - INV-DOM-PFM-SEC-003-20 operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-069 cap: CAP-PFM-SEC-012 categories: &ref_11 - rule - failure missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-012-define-a-customer-s-own-roles-and-policies.md - specs/platform/security/design/workflows/WF-PFM-SEC-008-flush-the-gateway-s-cached-decisions.md statement: 'Dedicated rule, failure proof remains incomplete for model customer responsibilities with roles and policies.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-012-14 - ATS-PFM-SEC-012-15 - ATS-PFM-SEC-012-16 - ATS-PFM-SEC-012-17 - ATS-PFM-SEC-012-18 missing_categories: *ref_11 permissions_to_complete: - key: platform.security-roles.read where_checked: api scope: tenant - key: platform.security-roles.manage where_checked: api scope: tenant - key: platform.security-policies.read where_checked: api scope: tenant - key: platform.security-policies.manage where_checked: api scope: tenant operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-070 cap: CAP-PFM-SEC-013 categories: &ref_12 - edge - failure - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md - specs/platform/security/design/workflows/WF-PFM-SEC-012-reconcile-shared-definitions-founding-staff-and-principals-on.md statement: 'Dedicated edge, failure, concurrency proof remains incomplete for publish shared access definitions from releases.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-013-12 - ATS-PFM-SEC-013-13 - ATS-PFM-SEC-013-14 - ATS-PFM-SEC-013-15 missing_categories: *ref_12 permissions_to_complete: [] operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-071 cap: CAP-PFM-SEC-014 categories: &ref_13 - rule - edge - failure missing_rules: - BR-CAP-PFM-SEC-014-13 unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-014-grant-roles-automatically-from-appointments-and-eligibility.md - specs/platform/security/design/workflows/WF-PFM-SEC-010-reconcile-derived-role-assignments.md - specs/platform/security/design/workflows/WF-PFM-SEC-014-register-confirm-and-sign-in-a-portal-member.md statement: 'Dedicated rule, edge, failure proof remains incomplete for derive member access from appointments and eligibility.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-014-11 - ATS-PFM-SEC-014-12 - ATS-PFM-SEC-014-13 missing_categories: *ref_13 permissions_to_complete: - key: platform.security-roles.manage where_checked: api scope: tenant - key: platform.eligibility.reconcile where_checked: api scope: global operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-072 cap: CAP-PFM-SEC-015 categories: &ref_14 - rule - transition - failure - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md - specs/platform/security/design/workflows/WF-PFM-SEC-008-flush-the-gateway-s-cached-decisions.md - specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md - specs/platform/security/design/workflows/WF-PFM-SEC-012-reconcile-shared-definitions-founding-staff-and-principals-on.md statement: 'Dedicated rule, transition, failure, concurrency proof remains incomplete for enforce access at request boundaries.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-015-12 - ATS-PFM-SEC-015-13 - ATS-PFM-SEC-015-14 - ATS-PFM-SEC-015-15 missing_categories: *ref_14 permissions_to_complete: - key: platform.application.access where_checked: api scope: tenant - key: platform.security-self.read where_checked: api scope: record operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-073 cap: CAP-PFM-SEC-016 categories: &ref_15 - validation - edge - failure - boundary - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-016-run-rhythm-s-own-staff-accounts-and-hq-roles.md - specs/platform/security/design/workflows/WF-PFM-SEC-005-invite-a-person-and-deliver-the-invitation.md - specs/platform/security/design/workflows/WF-PFM-SEC-007-suspend-reinstate-revoke-or-delete-a-membership.md - specs/platform/security/design/workflows/WF-PFM-SEC-012-reconcile-shared-definitions-founding-staff-and-principals-on.md statement: 'Dedicated validation, edge, failure, boundary, concurrency proof remains incomplete for administer rhythm staff memberships.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-016-02 - ATS-PFM-SEC-016-08 - ATS-PFM-SEC-016-09 - ATS-PFM-SEC-016-10 missing_categories: *ref_15 permissions_to_complete: - key: hq.staff.read where_checked: api scope: global - key: hq.staff.invite where_checked: api scope: global - key: hq.staff.disable where_checked: api scope: global - key: hq.staff.update where_checked: api scope: global - key: hq.roles.read where_checked: api scope: global - key: hq.roles.manage where_checked: api scope: global operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-074 cap: CAP-PFM-SEC-017 categories: &ref_16 - rule - edge - failure - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md - specs/platform/security/design/workflows/WF-PFM-SEC-008-flush-the-gateway-s-cached-decisions.md - specs/platform/security/design/workflows/WF-PFM-SEC-011-grant-and-end-staff-entry-to-a-customer-workspace.md - specs/platform/security/design/workflows/WF-PFM-SEC-012-reconcile-shared-definitions-founding-staff-and-principals-on.md statement: 'Dedicated rule, edge, failure, concurrency proof remains incomplete for control staff access to customer workspaces.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-017-14 - ATS-PFM-SEC-017-15 - ATS-PFM-SEC-017-16 - ATS-PFM-SEC-017-17 - ATS-PFM-SEC-017-18 - ATS-PFM-SEC-017-19 - ATS-PFM-SEC-017-20 - ATS-PFM-SEC-017-21 missing_categories: *ref_16 permissions_to_complete: - key: hq.tenant-access.request where_checked: api scope: global - key: hq.tenant-access.read where_checked: api scope: global - key: hq.emergency-access.use where_checked: api scope: global - key: hq.audit.read where_checked: api scope: global - key: hq.tenants.read where_checked: api scope: global - key: platform.staff-access.read where_checked: api scope: tenant - key: platform.staff-access.manage where_checked: api scope: tenant partial_invariants: - INV-DOM-PFM-SEC-003-18 operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-075 cap: CAP-PFM-SEC-018 categories: &ref_17 - rule - edge - failure - boundary - concurrency - invariant missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-018-stop-and-restart-another-service-s-calls-into-rhythm.md - specs/platform/security/design/workflows/WF-PFM-SEC-012-reconcile-shared-definitions-founding-staff-and-principals-on.md statement: 'Dedicated rule, edge, failure, boundary, concurrency, invariant proof remains incomplete for suspend and resume service principals.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-018-06 - ATS-PFM-SEC-018-07 - ATS-PFM-SEC-018-08 - ATS-PFM-SEC-018-09 missing_categories: *ref_17 permissions_to_complete: - key: hq.service-principals.read where_checked: api scope: global - key: hq.service-principals.manage where_checked: api scope: global operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-076 cap: CAP-PFM-SEC-019 categories: &ref_18 - rule - transition - invariant missing_rules: [] unreachable: - state: STATE-PFM-SEC-010 index: 2 source: FND-PFM-SEC-039 - state: STATE-PFM-SEC-010 index: 3 source: FND-PFM-SEC-039 source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-019-let-members-sign-up-and-sign-in-on-a-workspace-s-portal.md - specs/platform/security/design/workflows/WF-PFM-SEC-013-onboard-a-workspace-s-portal-sign-in-pool.md - specs/platform/security/design/workflows/WF-PFM-SEC-014-register-confirm-and-sign-in-a-portal-member.md statement: 'Dedicated rule, transition, invariant proof remains incomplete for register and authenticate portal members.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-019-09 - ATS-PFM-SEC-019-10 - ATS-PFM-SEC-019-11 - ATS-PFM-SEC-019-12 - ATS-PFM-SEC-019-13 missing_categories: *ref_18 permissions_to_complete: - key: platform.security-self.read where_checked: api scope: record - key: platform.tenants.onboard where_checked: api scope: global operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-077 cap: CAP-PFM-SEC-020 categories: &ref_19 - permission - edge - failure - concurrency missing_rules: [] unreachable: [] source: - specs/platform/security/planning/capabilities/CAP-PFM-SEC-020-link-a-portal-member-to-their-contact-record.md - specs/platform/security/design/workflows/WF-PFM-SEC-015-link-a-portal-member-to-a-contact.md statement: 'Dedicated permission, edge, failure, concurrency proof remains incomplete for match portal memberships to crm contacts.' kind: coverage-gap unbound_scenarios: - ATS-PFM-SEC-020-09 - ATS-PFM-SEC-020-10 - ATS-PFM-SEC-020-11 - ATS-PFM-SEC-020-12 - ATS-PFM-SEC-020-13 missing_categories: *ref_19 permissions_to_complete: - key: platform.security-self.read where_checked: api scope: record partial_invariants: - INV-DOM-PFM-SEC-003-22 operation_permission_gap: 'The listed permission rules have scenarios, but the register does not establish every allowed and refused operation-by-key combination.' - id: FND-PFM-SEC-078 kind: coverage-gap source: specs/platform/security/planning/acceptance/ affects: - FAS-PFM-SEC-01 - FAS-PFM-SEC-02 - FAS-PFM-SEC-03 - FAS-PFM-SEC-04 - FAS-PFM-SEC-05 - FAS-PFM-SEC-06 statement: Whole-feature chains need ordered executable proof. The custom-role browser chain has an executable binding candidate that the corpus validator currently rejects. validator_gap: source: 'rhythm-v2-docs:tools/check-corpus.mjs:refFields.TST' scenario: FAS-PFM-SEC-04-01 suite: TST-PFM-SEC-034 statement: Generic reference validation rejects a valid feature scenario before the scenario-aware executable-suite validation runs. validator_report_gap: source: 'rhythm-v2-docs:tools/check-corpus.mjs:report filename recognition' statement: The report whitelist accepts examination names but does not accept the requested testing-backfill report name. control_gap_evidence: - finding: FND-PFM-SEC-058 controls: - TC-LOG-001 - TC-PI-005 provenance: observed source: 'services-platform:docs/hq/rhythm-hq-plan.md#D8; modules/customers/services/persistence/customers.ts:deleteCustomer; modules/customers/aws/api/customers.routes.ts:deleteCustomer' related_finding: FND-PFM-SEC-003 - finding: FND-PFM-SEC-059 controls: - TC-PI-003 provenance: observed source: 'services-platform:docs/standards/record-write-contracts.md#D-05; docs/standards/record-write-contracts/compliance-by-service.md (services-platform W1, W2); modules/customers/aws/api/customer-api-mapper.ts:mapReplaceCustomerRequest; modules/customers/aws/api/customers.schemas.ts:hqCustomerPatchRequestSchema' related_finding: FND-PFM-SEC-004 - finding: FND-PFM-SEC-060 controls: - TC-AVL-004 - TC-PI-004 provenance: observed source: 'services-platform:modules/security/services/invitations/suspend-user.ts (header, steps 2 and 3); modules/security/services/invitations/revoke-user.ts (header); modules/security/services/dispatch/remove-pool-account.ts' related_finding: FND-PFM-SEC-037 - finding: FND-PFM-SEC-061 controls: - TC-PI-002 - TC-PI-003 - TC-IAM-004 provenance: observed source: 'services-platform:modules/security/services/invitations/accept-invitation.ts:acceptInvitation' related_finding: FND-PFM-SEC-052 - finding: FND-PFM-SEC-062 controls: - TC-PI-003 provenance: observed source: 'services-platform:modules/security/services/persistence/users.ts:linkPortalMemberContact; modules/security/db/users.table.ts:users_contact_idx; modules/security/services/persistence/portal-contact-challenges.ts:startPortalContactChallenge; modules/security/db/portal-contact-challenges.table.ts' related_finding: FND-PFM-SEC-054 - finding: FND-PFM-SEC-063 controls: - TC-PI-002 - TC-PI-003 provenance: observed source: 'services-platform:modules/security/services/staff-access/request-tenant-access.ts:requestTenantAccess; modules/security/services/persistence/staff-access-grants.ts:findOpenStaffAccessRequest, requestStaffAccessGrant; modules/security/db/staff-access-grants.table.ts' related_finding: FND-PFM-SEC-055 - finding: FND-PFM-SEC-064 controls: - TC-LOG-005 - TC-LOG-003 provenance: observed source: 'services-platform:modules/security/services/persistence/audit-events.ts:recordSecurityAuditEvent; modules/security/db/security-audit-events.table.ts; modules/security/services/audit/refused-attempts.ts:auditedAttempt; modules/tenants/services/lifecycle/participants.ts' related_finding: FND-PFM-SEC-056 - finding: FND-PFM-SEC-065 controls: - TC-IAM-003 provenance: observed source: 'services-platform:modules/security/aws/resources/identity-pool.cognito.ts:mfa' related_finding: BR-CAP-PFM-SEC-016-10 --- # Findings and Open Questions: Platform → Security, Workspaces and Customers ## Findings | id | severity | statement | affects | evidence | kind | |---|---|---|---|---|---| | `FND-PFM-SEC-001` | medium | The central registry’s console scope includes outdated or misplaced paths and omits relevant Security, sign-in and HQ records. The module charter now describes the actual registered-source interpretation, but the central registry row remains unchanged under this job’s edit boundary. | `MOD-PFM-SEC` | Structured evidence | inconsistency | | `FND-PFM-SEC-002` | medium | The milestone index supplies no dedicated security, workspace or customer milestone. Detailed intent therefore needs the cited approved plans, dated decisions, guided acceptance checkpoints or standards; observed code cannot establish product approval. The milestone-status standard remains a separate source of maturity guidance. | `MOD-PFM-SEC` | Structured evidence | undocumented | | `FND-PFM-SEC-003` | medium | Customer deletion checks workspace references and record locks. The accepted HQ plan additionally requires membership and custom-definition dependency checks, typed customer-name confirmation, a reason and security audit. Those additional safeguards remain unimplemented. | `CAP-PFM-SEC-001`, Affected business rule | Structured evidence | defect | | `FND-PFM-SEC-004` | medium | The record-write contract and current handlers differ on required versions and no-op writes. Missing replacement versions can surface as server faults, some patches compare a version read by the handler rather than one supplied by the client, and some HQ and definition edits accept no version. Current saves can advance version even without a field change. The product should reconcile these paths with the contract. | `CAP-PFM-SEC-001`, `CAP-PFM-SEC-002`, `CAP-PFM-SEC-012`, Affected business rule, Affected business rule, Affected business rule, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-005` | low | The selected catalog contains unused bulk-write, staff-update and HQ role-reading keys. Platform’s application-access key also supplies no application-access gate because Platform is exempt. Staff role management is evaluated when inviting another Rhythm Administrator rather than as a general role-edit route. The product should assign an operation or retire unused declarations. | `CAP-PFM-SEC-001`, `CAP-PFM-SEC-002`, `CAP-PFM-SEC-009`, `CAP-PFM-SEC-016`, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-006` | low | Six older operations remain reachable without a customer in their path: five membership lifecycle actions and the global permission-catalog read. Granted staff customer authority cannot use those legacy routes; customer-named replacements provide the intended scope. Their retirement remains debt. | `CAP-PFM-SEC-008`, `CAP-PFM-SEC-009`, `CAP-PFM-SEC-012` | Structured evidence | debt | | `FND-PFM-SEC-007` | low | Earlier HQ text describes generated references and a separate domain field, while the later readable-reference decision supersedes that model. Destructive confirmations also differ: retirement requests confirm the workspace name and reset confirms its reference. The product should align the old record and decide whether the two confirmations are intentional. | `CAP-PFM-SEC-003`, `CAP-PFM-SEC-004`, Affected business rule, Affected business rule, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-008` | medium | The automatic-assignment milestone remains proposed although reconciliation services, routes, scheduled work and password-sign-in integration exist. The role editor control is unfinished, development disables eligibility-conditioned permissions, and contact-versus-login ownership remains undecided. Implementation evidence does not settle those product choices. | `CAP-PFM-SEC-014`, Affected business rule, Affected business rule, Affected business rule, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-009` | low | The grant-slice decision record says disabled workspaces remain reachable through authorization, whereas the availability gate refuses ordinary workspace work while disabled. These are different enforcement layers. The code settles current availability, but the product still needs the deferred disabled-workspace decision. | `CAP-PFM-SEC-002`, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-010` | low | Authentication and authorization records carry inconsistent status language. Authentication’s final acceptance checkpoint supersedes its pending wording, while the administration text calls an authorization design approved whose own header still awaits review. Approval should be attributed to the particular recorded decision or checkpoint rather than these broad labels. | `CAP-PFM-SEC-005`, `CAP-PFM-SEC-006`, `CAP-PFM-SEC-012` | Structured evidence | inconsistency | | `FND-PFM-SEC-011` | low | Retirement recovery can restart scheduling or retry purge without a supplied version or a separate security audit event. The implementation settles that omission; the product should decide and add the recovery audit contract. | `CAP-PFM-SEC-004`, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-012` | medium | The gateway flush can succeed without evicting cached decisions. Stored revocation, deactivation and definition edits therefore differ from their effect on already authorized requests. The accepted staff-access bound permits roughly ninety seconds through combined cache and signed-context lifetimes; stronger immediate-cutoff promises remain unsupported. | `CAP-PFM-SEC-015`, `CAP-PFM-SEC-009`, `CAP-PFM-SEC-017`, Affected business rule, Affected business rule, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-013` | low | Public portal identity routes encounter availability checks before their handler-level neutral refusal. An unknown workspace can consequently differ from an available workspace without a portal. Security context also distinguishes unknown workspace references from reachable but forbidden ones under the documented isolation exception. | `CAP-PFM-SEC-019`, `CAP-PFM-SEC-007`, Affected business rule, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-014` | low | Principal management and workspace retirement requests have backend operations but no dedicated HQ console pages in the inspected scope. The product should decide the operator experience before presenting those workflows as complete screen-based administration. | `CAP-PFM-SEC-018`, `CAP-PFM-SEC-004`, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-015` | low | The HQ role plan limits Support’s retirement authority to reading, while the lifecycle plan and catalog reconciliation give Support hold and release authority. Code establishes the shipped definition, but the two product records need reconciliation. | `CAP-PFM-SEC-013`, `CAP-PFM-SEC-016`, `CAP-PFM-SEC-004`, Affected business rule, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-016` | medium | The implemented business go-live action does not require proof that initial import has completed. The persistence test explicitly treats that check as debt. The product should decide the required prerequisite before assuming handover is guarded. | `CAP-PFM-SEC-002`, `CAP-PFM-SEC-003`, Affected business rule, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-017` | low | The emergency-access plan names multi-factor authentication among safeguards and also records its phase-one deferral. Current emergency access does not require MFA. The product should keep the deferral visible and decide when the requirement becomes enforceable. | `CAP-PFM-SEC-017`, `CAP-PFM-SEC-006`, `CAP-PFM-SEC-016`, Affected business rule, Affected business rule, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-018` | low | Portal identity’s successful signup, recovery and resend handlers use the ordinary success status where the documented contract specifies created or accepted responses. The backend contract mismatch remains a proposed correction. | `CAP-PFM-SEC-019`, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-019` | medium | The inspected backend bindings do not provide complete route-specific proof of staff-role invitation restrictions or HQ suspend and revoke. Shared membership tests cover underlying services and mock browser tests exercise controls; neither should be represented as a complete HQ lifecycle acceptance test. | `CAP-PFM-SEC-016`, Affected business rule, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-020` | low | Deployed proof remains missing for ordinary uninvited Google entry and the gateway’s observable revocation window. Local tests and documentation establish parts of these mechanisms, including the founding-staff exception and flush execution, but do not measure those deployed outcomes. | `CAP-PFM-SEC-005`, `CAP-PFM-SEC-015`, Affected business rule, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-021` | low | An HQ customer editor can change the customer’s commercial reference under customer-update authority. Workspace commercial moves require a separate staff permission because they influence licensed applications. The product should decide whether this difference in authority is intended. | `CAP-PFM-SEC-001`, `CAP-PFM-SEC-002`, Affected business rule, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-022` | medium | Some lifecycle defaults were adopted under a standing order and await individual review, including the shorter never-activated waiting period and removal of workspace-scoped security events. Their implementation is evidence of behavior rather than a confirming decision. The affected capability intent and origins now preserve that distinction. | `CAP-PFM-SEC-004`, `CAP-PFM-SEC-011`, Affected business rule, Affected business rule | Structured evidence | undocumented | | `FND-PFM-SEC-023` | low | The original lifecycle plan lists five states; implementation also includes initial loading, added through the data-job plan. The later loading design explains the sixth state, but the earlier lifecycle summary remains inconsistent. | `CAP-PFM-SEC-002`, `CAP-PFM-SEC-003`, Affected business rule, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-024` | low | The security and lifecycle scopes both include workspace code, and data-job ownership also touches loading and reset. This layer assigns staff-facing requests here and participant execution to dependencies pending the ownership decision; overlapping source scope does not justify duplicate rule homes. | `CAP-PFM-SEC-003`, `CAP-PFM-SEC-004` | Structured evidence | inconsistency | | `FND-PFM-SEC-025` | low | Older records specify a three-hundred-second gateway cache, while the current authorizer and flush investigation establish sixty seconds. Specifications now use the current bound; the earlier records still require correction. | `CAP-PFM-SEC-015`, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-026` | low | No acceptance inventory for this module was identified in the registered scope. The attention inventory’s security-labelled journeys assess attention visibility and belong to that module; they do not seed security acceptance identifiers. | `MOD-PFM-SEC` | Structured evidence | undocumented | | `FND-PFM-SEC-027` | low | The invitation lifecycle record retains older disabled-account terminology and an undecided return path. Current membership operations distinguish suspension, reinstatement and revocation, with reinvitation after removal. The old explanatory record needs to reflect that lifecycle. | `CAP-PFM-SEC-009` | Structured evidence | debt | | `FND-PFM-SEC-028` | low | Resolved in this continuation: both named briefs are present and were read. The earlier checkout absence no longer prevents comparison with the drafting and examination instructions. | `MOD-PFM-SEC` | Structured evidence | undocumented | | `FND-PFM-SEC-029` | medium | Resolved for this corpus text: the continuation rewrites capability, acceptance, journey and concept descriptions to distinguish fresh evaluation from cached requests and flush submission from eviction. The implementation limitation remains recorded separately as cache debt. | `CAP-PFM-SEC-009`, `CAP-PFM-SEC-010`, `CAP-PFM-SEC-012`, `CAP-PFM-SEC-017`, `CAP-PFM-SEC-020` | Structured evidence | inconsistency | | `FND-PFM-SEC-030` | medium | The contact-claim decision approves the signed claim, not candidate selection, challenge limits or contact creation. Likewise the proposed eligibility milestone cannot approve its detailed behavior. Unrelated origins are removed, and unreviewed lifecycle and audit defaults remain proposed rather than confirmed through code observation. | `CAP-PFM-SEC-014`, `CAP-PFM-SEC-020` | Structured evidence | inconsistency | | `FND-PFM-SEC-031` | high | Resolved for final text: the remaining capability and acceptance pairs, journeys, charter, ledger and finding descriptions receive this OpenAI continuation. Completion of wording and corpus checks does not resolve the product questions or the behavioral proof gaps retained in other findings. | `MOD-PFM-SEC` | Structured evidence | debt | | `FND-PFM-SEC-032` | medium | Customer replacement tests assert absence of an obsolete camel-case commercial field while the mapper returns snake-case fields. Their assertions do not establish clearing of the current persisted value. The affected rule remains unknown and the acceptance scenario has no insufficient binding. | `CAP-PFM-SEC-001`, `ATS-PFM-SEC-001` | Structured evidence | inconsistency | | `FND-PFM-SEC-033` | medium | The ordinary customer-create handler performs standing-access reconciliation, while HQ customer creation writes the record without that hook. The HQ creation test does not prove the missing side effect. The product should align the paths and add proof before assuming every newly created customer has those standing grants. | `CAP-PFM-SEC-001`, `CAP-PFM-SEC-017` | Structured evidence | defect | | `FND-PFM-SEC-034` | medium | Inventory and concept grain are resolved in this continuation: the selected permission groups, asynchronous declarations and browser files are independently counted, and access definitions and grant records become User Account facets with their former identifiers retained as superseded. Mapping is still distinct from complete behavioral proof; asynchronous recovery gaps are named in the separate finding. | `MOD-PFM-SEC`, `CON-PFM-SEC-004`, `CON-PFM-SEC-005`, `CON-PFM-SEC-006` | Structured evidence | debt | | `FND-PFM-SEC-035` | medium | Workspace replacement tests likewise inspect absence of the obsolete camel-case commercial field rather than the mapper’s current field. They do not prove response or stored-value clearing. The rule stays unknown until a readback test observes the current persisted field. | `CAP-PFM-SEC-002`, `ATS-PFM-SEC-002` | Structured evidence | inconsistency | | `FND-PFM-SEC-036` | medium | The original asynchronous count omitted the derived-reconcile dispatcher schedule and both dead-letter companions. The corrected charter names two primary queues, their two dead-letter queues and three schedules. Retry exhaustion, redrive, batch failure and dispatcher recovery still need explicit acceptance coverage instead of a resource-count claim. | `CAP-PFM-SEC-009`, `CAP-PFM-SEC-014`, `MOD-PFM-SEC` | Structured evidence | debt | | `FND-PFM-SEC-037` | medium | Suspension and reinstatement attempt provider synchronization once after membership commit and return provider trouble separately. Revocation/deletion instead persist queue work with bounded retries and dead-letter recovery. The design proposes durable synchronization for the two single-attempt actions; fresh authority and provider sign-in state can differ until repair. | `CAP-PFM-SEC-009`, `WF-PFM-SEC-007`, Affected business rule, Affected business rule | Structured evidence | defect | | `FND-PFM-SEC-038` | low | HQ has no observed screen for approved-access requests, request withdrawal, initial-load opening, reset or loaded activation. The service operations exist, while the current staff surface offers emergency entry and selected grant-ending controls. Product should decide which direct-call journeys need screens before implementation preparation. | `CAP-PFM-SEC-003`, `CAP-PFM-SEC-017`, `SCR-PFM-SEC-027` | Structured evidence | debt | | `FND-PFM-SEC-039` | low | Pool readers honor suspended and retired values, but no observed administration operation writes them. The available persistence setter has no production caller in the examined path. Their writer and operator behavior remain unknown rather than invented lifecycle transitions. | `STATE-PFM-SEC-010`, `CAP-PFM-SEC-019` | Structured evidence | undocumented | | `FND-PFM-SEC-040` | low | The module exposes provisioning notifications but no declared domain-change events for customer, workspace, membership or access changes. Participant calls and evaluated context carry the observed cross-service effects. Product should confirm or replace that event boundary; code alone does not approve it. | `SVC-PFM-SEC-security`, `SVC-PFM-SEC-tenants`, `SVC-PFM-SEC-customers` | Structured evidence | undocumented | | `FND-PFM-SEC-041` | low | No examined module path calls a model. Contracts therefore have empty inference lists and no inference artifacts are needed. The module charter still lacks the convention’s explicit no-inference sentence; it is a planning artifact outside this examination’s edit boundary. | `MOD-PFM-SEC` | Structured evidence | undocumented | | `FND-PFM-SEC-042` | low | A stopped retirement watcher can leave a valid request without a running schedule until an operator resumes it. Delivery-failure alarms cover gating notices, but no inspected alarm establishes detection of a stopped watcher. The request can stall after eligibility without the intended operator signal. | `WF-PFM-SEC-003`, `CAP-PFM-SEC-004`, Affected business rule | Structured evidence | debt | | `FND-PFM-SEC-043` | low | Loading-to-retirement is declared in the lifecycle graph but unreachable through the request capability: request accepts active or failed provisioning and loading cannot be disabled. A staff member must currently activate, disable and then request retirement. Product should settle whether to expose loading retirement or withdraw the declared edge. | `STATE-PFM-SEC-001`, `CAP-PFM-SEC-004`, Affected business rule | Structured evidence | inconsistency | | `FND-PFM-SEC-044` | medium | Loading activation changes readiness without stamping first activation. The corrected design preserves the existing timestamp; product should decide whether imported workspaces need a separate activation timestamp before waiting-period policy relies on it. | `STATE-PFM-SEC-001`, `WF-PFM-SEC-002`, `DOM-PFM-SEC-002` | Structured evidence | inconsistency | | `FND-PFM-SEC-045` | medium | Invitation issuance precedes delivery and can leave a valid hashed token after a withheld or failed send. Concurrent e-mail completion does not determine which link remains valid; the outstanding invitation and token digest do. The design now separates issuance, delivery and acceptance, while delivery-race proof remains needed. | `STATE-PFM-SEC-005`, `WF-PFM-SEC-005` | Structured evidence | debt | | `FND-PFM-SEC-046` | medium | The one-minute removal dispatcher schedule is a recovery opportunity, not a completion deadline. Provider failures, queue backlog and eight receives can leave pool work in a dead-letter queue requiring operator redrive. The design removes the guaranteed completion time; exhaustion and recovery still need acceptance proof. | `STATE-PFM-SEC-004`, `WF-PFM-SEC-007` | Structured evidence | debt | | `FND-PFM-SEC-047` | high | Catalog reconciliation commits before the route registry is activated in a different store. Failure between them can leave the new permission catalog beside the old active manifest and the staged manifest. The design records this seam instead of claiming rollback across both stores; recovery by repeating activation needs explicit proof. | `WF-PFM-SEC-012`, `SVC-PFM-SEC-security` | Structured evidence | debt | | `FND-PFM-SEC-048` | medium | HQ console controls gate staff suspension and reinstatement with staff-update authority, while both routes require staff-disable authority. The roles page gates on role-reading authority while its route requires staff-reading authority. The corrected Screen Contracts preserve both sides; product should align the checks and prove access with independently granted keys. | `SCR-PFM-SEC-029`, `SCR-PFM-SEC-030`, `SCR-PFM-SEC-031`, `CAP-PFM-SEC-016` | Structured evidence | defect | | `FND-PFM-SEC-049` | low | The bare Security page always redirects to Users; it does not select a permitted section from the security context. A person allowed to read roles or policies without user-reading authority can reach a refused Users page through this entry. The design now states the fixed destination; product should decide whether entry should choose a section the person can read. | `SCR-PFM-SEC-001` | Structured evidence | defect | | `FND-PFM-SEC-050` | medium | Purge finalization can complete the database request and remove the workspace before the external ledger write succeeds. A later failure does not change a completed request to failed, so the request-specific purge retry is unavailable; task replay can finish the outstanding ledger work. The design records the completed-request and missing-ledger outcome, and operator recovery needs a documented, proved path. | `WF-PFM-SEC-004`, `STATE-PFM-SEC-003`, `SVC-PFM-SEC-tenants` | Structured evidence | debt | | `FND-PFM-SEC-051` | medium | Retirement notice delivery precedes recording the delivered result. A successful send followed by a failed outcome write is sent again on retry, so the draft’s exactly-once claim is false. The corrected workflow records at-least-once delivery; product should decide whether duplicate reminders need provider-level deduplication. | `WF-PFM-SEC-003` | Structured evidence | debt | | `FND-PFM-SEC-052` | high | Concurrent password acceptances can both pass token checks and set the provider password before conditional database consumption allows one winner. The losing request can therefore affect the credential even though its activation is refused. The design limits single-use to database consumption; acceptance needs a concurrency proof and a decision about credential ownership. | `WF-PFM-SEC-006`, `STATE-PFM-SEC-005` | Structured evidence | debt | | `FND-PFM-SEC-053` | medium | Contact matching can create a CRM contact before the separate membership-link write succeeds. A refused or failed link can leave a created contact without its intended membership link, and decline can intentionally create a possible duplicate. The workflow now exposes the cross-service gap; compensation or convergent retry needs proof. | `WF-PFM-SEC-015` | Structured evidence | debt | | `FND-PFM-SEC-054` | high | Contact linking checks for another link inside an update, but the declared contact index is not unique and different members do not share a lock. Challenge starts likewise supersede existing rows before inserting without a declared live-row uniqueness constraint or shared member lock. These checks support sequential refusal, not proved exclusion under concurrency. The design marks both concurrency guarantees unknown; simultaneous linking and challenge-start scenarios are required. | `DOM-PFM-SEC-003`, `STATE-PFM-SEC-011`, `WF-PFM-SEC-015` | Structured evidence | debt | | `FND-PFM-SEC-055` | medium | Staff request submission reads for an existing open request before inserting, while declared unique indexes protect active grants only. No shared request-target lock or unique requested-row index is present in the inspected path. The corrected design distinguishes sequential duplicate checks from active-grant uniqueness and leaves concurrent open-request exclusion unknown pending proof. | `DOM-PFM-SEC-003`, `STATE-PFM-SEC-007`, `WF-PFM-SEC-011` | Structured evidence | debt | | `FND-PFM-SEC-056` | medium | The ordinary security-history writer appends events, but its raw before/after payloads have no general credential-rejection filter, and the cited table declaration does not establish database refusal of updates or deletion. Authorized workspace purge also deletes scoped history. The draft’s unconditional database-enforced append-only and secret-exclusion invariant is therefore unproved; the design now states the observed writer behavior and retention exception. | `DOM-PFM-SEC-003`, `ADR-PFM-SEC-014` | Structured evidence | debt | | `FND-PFM-SEC-057` | low | Workflow start hops name a shared job-engine function outside the two pinned source repositories. The pinned job standard documents the start-after-commit contract and module call sites use it, but this examination cannot open that dependency implementation at an independently pinned library commit. The hops remain documented rather than observed evidence, and a library pin plus execution proof is needed before treating the dependency internals as verified. | `WF-PFM-SEC-001`, `WF-PFM-SEC-003`, `ADR-PFM-SEC-005` | Structured evidence | undocumented | | `FND-PFM-SEC-058` | medium | Dedicated rule, edge, failure proof remains incomplete for establish and administer a customer. | `CAP-PFM-SEC-001` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-059` | medium | Dedicated failure proof remains incomplete for maintain workspace information and operating status. | `CAP-PFM-SEC-002` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-060` | medium | Dedicated invariant proof remains incomplete for prepare a workspace for customer use. | `CAP-PFM-SEC-003` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-061` | medium | Dedicated rule, transition, edge proof remains incomplete for manage a workspace retirement request. | `CAP-PFM-SEC-004` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-062` | medium | Dedicated failure, concurrency proof remains incomplete for join through an invitation. | `CAP-PFM-SEC-005` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-063` | medium | Dedicated rule, edge, concurrency proof remains incomplete for use and recover a console sign-in. | `CAP-PFM-SEC-006` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-064` | medium | Dedicated concurrency, invariant proof remains incomplete for understand available workspace access. | `CAP-PFM-SEC-007` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-065` | medium | Dedicated rule, edge, concurrency proof remains incomplete for offer and manage an invitation. | `CAP-PFM-SEC-008` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-066` | medium | Dedicated rule, permission, edge proof remains incomplete for maintain console memberships. | `CAP-PFM-SEC-009` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-067` | medium | Dedicated validation, edge, failure proof remains incomplete for assign roles within a controlled scope. | `CAP-PFM-SEC-010` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-068` | medium | Dedicated validation, edge, concurrency proof remains incomplete for review security changes and refused attempts. | `CAP-PFM-SEC-011` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-069` | medium | Dedicated rule, failure proof remains incomplete for model customer responsibilities with roles and policies. | `CAP-PFM-SEC-012` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-070` | medium | Dedicated edge, failure, concurrency proof remains incomplete for publish shared access definitions from releases. | `CAP-PFM-SEC-013` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-071` | medium | Dedicated rule, edge, failure proof remains incomplete for derive member access from appointments and eligibility. | `CAP-PFM-SEC-014` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-072` | medium | Dedicated rule, transition, failure, concurrency proof remains incomplete for enforce access at request boundaries. | `CAP-PFM-SEC-015` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-073` | medium | Dedicated validation, edge, failure, boundary, concurrency proof remains incomplete for administer rhythm staff memberships. | `CAP-PFM-SEC-016` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-074` | medium | Dedicated rule, edge, failure, concurrency proof remains incomplete for control staff access to customer workspaces. | `CAP-PFM-SEC-017` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-075` | medium | Dedicated rule, edge, failure, boundary, concurrency, invariant proof remains incomplete for suspend and resume service principals. | `CAP-PFM-SEC-018` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-076` | medium | Dedicated rule, transition, invariant proof remains incomplete for register and authenticate portal members. | `CAP-PFM-SEC-019` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-077` | medium | Dedicated permission, edge, failure, concurrency proof remains incomplete for match portal memberships to crm contacts. | `CAP-PFM-SEC-020` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-078` | medium | The new whole-feature chains lack executable suites that prove every ordered step. Existing capability assertions remain independently bound. | `undefined` | testing_coverage_gaps frontmatter | coverage-gap | | `FND-PFM-SEC-078` | medium | Whole-feature chains need ordered executable proof; the existing custom-role browser chain cannot be bound until valid feature scenario references pass the validator. | `FAS-PFM-SEC-01`, `FAS-PFM-SEC-02`, `FAS-PFM-SEC-03`, `FAS-PFM-SEC-04`, `FAS-PFM-SEC-05`, `FAS-PFM-SEC-06` | testing_coverage_gaps frontmatter | coverage-gap | ## Open Questions | id | question | why_it_matters | options | recommendation | affects | |---|---|---|---|---|---| | `OQ-PFM-SEC-001` | How should workspace setup, loading and retirement ownership be divided? | Staff-facing requests and cross-service execution share workspace sources, while loading also involves data jobs. A product decision is needed to keep each rule in one module. | A: retain staff decisions here and participant protocols in lifecycle; B: move setup and retirement entirely to lifecycle; C: use A and place loading and reset decisions with data jobs. | The product should choose A, preserving the staff administration outcome here and execution protocols with their owners. | `CAP-PFM-SEC-003`, `CAP-PFM-SEC-004`, `MOD-PFM-SEC` | | `OQ-PFM-SEC-002` | Who may work in a disabled workspace? | Current availability permits staff HQ work while refusing ordinary customer work. Read-only customer administration or exports would require an explicit exception; the recorded decision remains deferred. | A: authorized HQ staff only; B: also allow customer administrators read-only; C: refuse all workspace work, including staff. | The product should confirm A if the observed boundary is intended, with any exception recorded explicitly. | `CAP-PFM-SEC-002` | | `OQ-PFM-SEC-003` | Should derived access identify a contact or a sign-in account? | Contact-keyed assignments can precede membership and align with association responsibilities. Account-keyed assignments offer a different administrative model; the proposed milestone leaves that choice open. | A: contact subjects; B: account subjects; C: let each source choose either subject. | The product should select contact subjects because appointments and eligibility describe association people, then document merge and membership implications. | `CAP-PFM-SEC-014` | | `OQ-PFM-SEC-004` | Does the existing User Account grouping need a future planning revision? | The current planning layer already groups definitions, assignments and staff grants as facets, and this design retains that decision with separate aggregate lifecycles. | Keep the present grouping, or commission a separate planning review before any concept split. | Retain the current grouping for this examination; no superseded concept is reinstated here. | `CON-PFM-SEC-003`, `DOM-PFM-SEC-003`, `ADR-PFM-SEC-002` |