--- id: ATS-PFM-SEC-018 scope: CAP-PFM-SEC-018 product_area: platform module: security revision: 3 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 scenarios: - id: ATS-PFM-SEC-018-01 title: List principals only for authorized staff level: api proves: - BR-CAP-PFM-SEC-018-01 preconditions: 'Prepare a staff reader, customer Administrator and anonymous caller.' steps: Request the principal list with each caller. expected: >- Return kind and status to the staff reader; return 403 to customer authority and 401 without authentication. negative: true data_needs: Use the records described in the setup. bound_to: - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a staff reader 200 with every principal, this suite’s among them with its kind and status - TST-PFM-SEC-184 - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a customer's administrator 403, holding every key of their own customer - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses an anonymous call 401 provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a staff reader 200 with every principal, this suite’s among them with its kind and status category: permission test_references: - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a staff reader 200 with every principal, this suite’s among them with its kind and status - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a customer's administrator 403, holding every key of their own customer - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses an anonymous call 401 action_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a staff reader 200 with every principal, this suite’s among them with its kind and status assertion_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a staff reader 200 with every principal, this suite’s among them with its kind and status binding_scope: >- The binding applies to the cited executable observations and their dependency boundary. Extra setup, operations or combinations in this scenario still require evidence before the whole scenario is qualified. - id: ATS-PFM-SEC-018-02 title: Audit each effective status transition once level: api proves: - BR-CAP-PFM-SEC-018-02 preconditions: Prepare an active principal and an authorized manager and reader. steps: 'Suspend twice, resume and attempt management as the reader.' expected: >- The first suspension advances the version and creates one event; the repeat creates none. Resumption records widening, and the reader cannot manage status. negative: true data_needs: Use the records described in the setup. bound_to: - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the suspension: the staff member, Rhythm’s customer, narrowing, from active to suspended - TST-PFM-SEC-184 - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a second suspension 200 and records nothing more, the principal being suspended already - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the resumption as widening, from suspended to active - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a staff member who holds the read and not the manage 403 provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the suspension: the staff member, Rhythm’s customer, narrowing, from active to suspended category: transition test_references: - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the suspension: the staff member, Rhythm’s customer, narrowing, from active to suspended - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a second suspension 200 and records nothing more, the principal being suspended already - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the resumption as widening, from suspended to active - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a staff member who holds the read and not the manage 403 action_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the suspension: the staff member, Rhythm’s customer, narrowing, from active to suspended assertion_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the suspension: the staff member, Rhythm’s customer, narrowing, from active to suspended binding_scope: >- The binding applies to the cited executable observations and their dependency boundary. Extra setup, operations or combinations in this scenario still require evidence before the whole scenario is qualified. - id: ATS-PFM-SEC-018-03 title: Separate unknown and malformed principal identifiers level: api proves: - BR-CAP-PFM-SEC-018-03 preconditions: Prepare an unknown valid identifier and a malformed one. steps: Request suspension or resumption with each. expected: >- Return 404 and a refusal audit event for the unknown id without creating a principal; return 400 for malformed input. negative: true data_needs: Use the records described in the setup. bound_to: - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id no principal holds 404 - TST-PFM-SEC-184 - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the refused suspension of that id, naming the staff member - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id outside the registry’s grammar 400 provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id no principal holds 404 category: validation test_references: - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id no principal holds 404 - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the refused suspension of that id, naming the staff member - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id outside the registry’s grammar 400 action_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id no principal holds 404 assertion_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id no principal holds 404 binding_scope: >- The binding applies to the cited executable observations and their dependency boundary. Extra setup, operations or combinations in this scenario still require evidence before the whole scenario is qualified. - id: ATS-PFM-SEC-018-04 title: Enforce registry status in a receiving handler level: api proves: - BR-CAP-PFM-SEC-018-04 preconditions: Prepare a principal invoking a handler that reads the registry. steps: 'Invoke while active, suspended and resumed.' expected: >- Serve active and resumed calls and return 403 while suspended. This binding does not measure deployed cache propagation. negative: true data_needs: Use the records described in the setup. bound_to: - >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is served 200 - TST-PFM-SEC-185 - >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is refused 403 provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is served 200 category: interaction test_references: - >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is served 200 - >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is refused 403 action_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is served 200 assertion_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is served 200 binding_scope: >- The binding applies to the cited executable observations and their dependency boundary. Extra setup, operations or combinations in this scenario still require evidence before the whole scenario is qualified. - id: ATS-PFM-SEC-018-05 title: Preserve existing principals during activation level: api proves: - BR-CAP-PFM-SEC-018-05 preconditions: Prepare a registry containing a suspended principal and a seed list with missing principals. steps: 'Reconcile twice, then submit a seed the database rejects.' expected: >- Insert missing principals as active, preserve existing names and suspension, and report the rejected seed without throwing an activation failure. negative: true data_needs: Use the records described in the setup. bound_to: - >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#answers both as inserted, and none unchanged - TST-PFM-SEC-177 - >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#leaves it suspended, under its stored name, at its version - >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#answers the failure rather than throwing, so the activation goes on, having inserted nothing provenance: test source: >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#answers both as inserted, and none unchanged category: transition test_references: - >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#answers both as inserted, and none unchanged - >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#leaves it suspended, under its stored name, at its version - >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#answers the failure rather than throwing, so the activation goes on, having inserted nothing action_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#answers both as inserted, and none unchanged assertion_evidence: provenance: test source: >- services-platform:modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js#answers both as inserted, and none unchanged binding_scope: >- The binding applies to the cited executable observations and their dependency boundary. Extra setup, operations or combinations in this scenario still require evidence before the whole scenario is qualified. - id: ATS-PFM-SEC-018-06 title: 'Service principal: active to suspended' category: transition level: api proves: - BR-CAP-PFM-SEC-018-02 state_model: STATE-PFM-SEC-009 transition: from: active to: suspended index: 0 preconditions: >- Prepare a run-owned service principal in active state with the authority and inputs required by the cited transition. steps: - do: Suspend the registered caller as authorized staff and inspect status history. expect: >- After the stated action, observe the service principal in suspended state. This case does not require an additional history event unless the transition explicitly defines one. provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. expected: >- After the stated action, observe the service principal in suspended state. This case does not require an additional history event unless the transition explicitly defines one. negative: false data_needs: >- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time. bound_to: [] provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. guard_cases: The principal exists and the caller has service-principal management authority. side_effects_to_verify: - Record a narrowing event in the status transaction transition_assertion: state: suspended provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. action_evidence: provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. assertion_evidence: provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. binding_scope: >- No executable assertion is bound. The scenario specifies proposed proof and does not establish implemented or passing behavior. - id: ATS-PFM-SEC-018-07 title: 'Service principal: suspended to active' category: transition level: api proves: - BR-CAP-PFM-SEC-018-02 state_model: STATE-PFM-SEC-009 transition: from: suspended to: active index: 1 preconditions: >- Prepare a run-owned service principal in suspended state with the authority and inputs required by the cited transition. steps: - do: Resume the registered caller as authorized staff and inspect widening history. expect: >- After the stated action, observe the service principal in active state. This case does not require an additional history event unless the transition explicitly defines one. provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. expected: >- After the stated action, observe the service principal in active state. This case does not require an additional history event unless the transition explicitly defines one. negative: false data_needs: >- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time. bound_to: [] provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. guard_cases: The caller has service-principal management authority. side_effects_to_verify: - Record a widening event transition_assertion: state: active provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. action_evidence: provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. assertion_evidence: provenance: proposed source: - 'services-platform:modules/security/services/service-principals/principal-status.ts' - >- services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1. binding_scope: >- No executable assertion is bound. The scenario specifies proposed proof and does not establish implemented or passing behavior. - id: ATS-PFM-SEC-018-08 title: Suspend and resume service principals with enforce access at request boundaries category: interaction level: api proves: - BR-CAP-PFM-SEC-015-13 - BR-CAP-PFM-SEC-018-04 exercises: - CAP-PFM-SEC-018 - CAP-PFM-SEC-015 preconditions: An active registered service principal can call its declared operation. steps: 'Suspend it, wait for registry refresh, call again, resume it, and repeat after refresh.' expected: The suspended caller is refused; the resumed eligible caller succeeds without deployment. negative: true data_needs: >- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. bound_to: [] provenance: proposed source: - >- services-platform:modules/security/tests/unit/authorizer/service-function-rules.spec.ts#refuses a route whose catalog permission is sensitive behind a function that is not, naming the key - >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is refused 403 action_evidence: provenance: proposed source: - >- services-platform:modules/security/tests/unit/authorizer/service-function-rules.spec.ts#refuses a route whose catalog permission is sensitive behind a function that is not, naming the key - >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is refused 403 assertion_evidence: provenance: proposed source: - >- services-platform:modules/security/tests/unit/authorizer/service-function-rules.spec.ts#refuses a route whose catalog permission is sensitive behind a function that is not, naming the key - >- services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is refused 403 binding_scope: >- No executable assertion is bound. The scenario specifies proposed proof and does not establish implemented or passing behavior. - id: ATS-PFM-SEC-018-09 title: Suspend and resume service principals with administer rhythm staff memberships category: interaction level: api proves: - BR-CAP-PFM-SEC-016-01 - BR-CAP-PFM-SEC-018-01 exercises: - CAP-PFM-SEC-018 - CAP-PFM-SEC-016 preconditions: 'A customer administrator, a staff reader and a Rhythm Administrator are available.' steps: Read the principal register and attempt suspension with each identity. expected: Only authorized staff can read it and only the management key permits suspension. negative: false data_needs: >- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. bound_to: [] provenance: proposed source: - >- services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#refuses an administrator of a customer, holding every key at that customer, as 403 - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a customer's administrator 403, holding every key of their own customer action_evidence: provenance: proposed source: - >- services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#refuses an administrator of a customer, holding every key at that customer, as 403 - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a customer's administrator 403, holding every key of their own customer assertion_evidence: provenance: proposed source: - >- services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#refuses an administrator of a customer, holding every key at that customer, as 403 - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a customer's administrator 403, holding every key of their own customer binding_scope: >- No executable assertion is bound. The scenario specifies proposed proof and does not establish implemented or passing behavior. evidence: - >- Pinned services-platform references for the structured rows: modules/security/tests/integration/services/provisioning/ensure-service-principals.integration.spec.js; modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js; modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js. - >- Testing back-fill reviews the pinned suite assertions, related capabilities, domain invariants, state transitions and workflow failure boundaries. New unbound rows remain proposed. coverage: rule: 'gap: FND-PFM-SEC-075' transition: covered validation: covered permission: covered edge: 'gap: FND-PFM-SEC-075' failure: 'gap: FND-PFM-SEC-075' boundary: 'gap: FND-PFM-SEC-075' concurrency: 'gap: FND-PFM-SEC-075' invariant: 'gap: FND-PFM-SEC-075' interaction: covered coverage_notes: rule: No scenario isolates this category. The referenced finding retains the missing design proof. edge: No scenario isolates this category. The referenced finding retains the missing design proof. failure: No scenario isolates this category. The referenced finding retains the missing design proof. boundary: No scenario isolates this category. The referenced finding retains the missing design proof. concurrency: No scenario isolates this category. The referenced finding retains the missing design proof. invariant: No scenario isolates this category. The referenced finding retains the missing design proof. invariant_proofs: [] permission_proof_review: - key: hq.service-principals.read scenario_candidates: - ATS-PFM-SEC-018-01 - ATS-PFM-SEC-018-02 - ATS-PFM-SEC-018-06 - ATS-PFM-SEC-018-07 - ATS-PFM-SEC-018-09 qualification: >- These are candidate scenarios for the authority boundary, not an exhaustive allowed/refused matrix for this key. The finding retains combinations not established by the executable assertions. gap: FND-PFM-SEC-075 provenance: inferred source: >- specs/platform/security/planning/capabilities/CAP-PFM-SEC-018-stop-and-restart-another-service-s-calls-into-rhythm.md - key: hq.service-principals.manage scenario_candidates: - ATS-PFM-SEC-018-01 - ATS-PFM-SEC-018-02 - ATS-PFM-SEC-018-06 - ATS-PFM-SEC-018-07 - ATS-PFM-SEC-018-09 qualification: >- These are candidate scenarios for the authority boundary, not an exhaustive allowed/refused matrix for this key. The finding retains combinations not established by the executable assertions. gap: FND-PFM-SEC-075 provenance: inferred source: >- specs/platform/security/planning/capabilities/CAP-PFM-SEC-018-stop-and-restart-another-service-s-calls-into-rhythm.md examiner: codex examined_at: '2026-10-23' final_text: OpenAI --- # Suspend and resume service principals: Capability Test Specification ## Coverage | Required rule | Scenario or finding | |---|---| | `BR-CAP-PFM-SEC-018-01` | `ATS-PFM-SEC-018-01`, `ATS-PFM-SEC-018-09` | | `BR-CAP-PFM-SEC-018-02` | `ATS-PFM-SEC-018-02`, `ATS-PFM-SEC-018-06`, `ATS-PFM-SEC-018-07` | | `BR-CAP-PFM-SEC-018-03` | `ATS-PFM-SEC-018-03` | | `BR-CAP-PFM-SEC-018-04` | `ATS-PFM-SEC-018-04`, `ATS-PFM-SEC-018-08` | | `BR-CAP-PFM-SEC-018-05` | `ATS-PFM-SEC-018-05` | The category map records specified proof. A covered category can contain proposed scenarios; it does not mean the checks have run. The bindings identify individual executable contributions, while findings retain missing rules, permissions, transitions and assertions. ## Interactions With Related Capabilities The interaction scenarios connect this capability to the related actions and workflow handoffs named in their proof references. Each case observes the outcome after the connected action changes records or available authority. A collection of separately bound checks does not establish an ordered feature journey. Source revisions and assertion references are recorded in frontmatter. Steps and expected observations carry separate evidence annotations. Proposed checks remain distinct from executable test statements, and static review supplies no run result.