---
id: TST-PFM-SEC-034
title: Roles console checks
kind: browser-lifecycle
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
repository: react-console
files:
  - e2e/security/roles.spec.ts
implements:
  - ATS-PFM-SEC-010-13
  - ATS-PFM-SEC-012-08
  - ATS-PFM-SEC-012-13
  - FAS-PFM-SEC-04-01
environment: deployed-dev
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 10
isolation: >-
  Use the suite’s existing disposable identities and workspace fixture boundary; retain shared
  development records.
assertion_evidence:
  - provenance: test
    source: 'react-console:e2e/security/roles.spec.ts#a custom role through its whole life'
  - provenance: test
    source: 'react-console:e2e/security/roles.spec.ts#is created from a name and a permission'
  - provenance: test
    source: 'react-console:e2e/security/roles.spec.ts#is on the Roles list, searchable, and marked custom'
  - provenance: test
    source: 'react-console:e2e/security/roles.spec.ts#is edited, and the change survives a reload'
  - provenance: test
    source: >-
      react-console:e2e/security/roles.spec.ts#is given to a person, who then shows on its Members
      tab
  - provenance: test
    source: >-
      react-console:e2e/security/roles.spec.ts#is archived once nobody holds it, and leaves the
      active list
  - provenance: test
    source: >-
      react-console:e2e/security/roles.spec.ts#refuses to archive a role somebody still holds, and
      names them
  - provenance: test
    source: >-
      react-console:e2e/security/roles.spec.ts#shows a built-in role read-only, and duplicates it
      into one that can be changed
dependency_evidence: >-
  The browser drives the development console using the suite’s configured identities and records.
  Service availability, sign-in prerequisites and fixture cleanup remain requirements for a
  successful run.
evidence:
  - 'react-console:e2e/security/roles.spec.ts'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
---
# Roles console checks

## Verification Boundary

The file drives the console in the configured development environment. The assertion references identify the source checks for roles.

## What This Suite Proves

The serial browser chain follows one custom role through creation, search, editing, assignment, withdrawal and archive. It checks that the Members tab reflects the assignment and its removal. Separate cases check the held-role archive refusal and the editable copy of a built-in role; these checks do not establish a change in effective request authority.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The browser drives the development console using the suite’s configured identities and records. Service availability, sign-in prerequisites and fixture cleanup remain requirements for a successful run.

## Must Not Be Doubled

Keep the browser or public request path and the service decisions being claimed real. Any intercepted provider response limits proof at that boundary.