--- id: TST-PFM-SEC-052 title: Definitions request checks kind: api-lifecycle product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/e2e/definitions.e2e.spec.js implements: - ATS-PFM-SEC-010-11 - ATS-PFM-SEC-012-01 - ATS-PFM-SEC-012-02 - ATS-PFM-SEC-012-07 - ATS-PFM-SEC-012-08 - ATS-PFM-SEC-012-11 - ATS-PFM-SEC-012-12 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 5 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#security definitions API (end to end) - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#the policies of a customer - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#creates a policy and answers it with its reference, its rules and its version - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#lists the customer's own policies beside Rhythm's, each with the reference a client sends back - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers each policy row its rule count and how many roles use it - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers a policy the roles that use it, each with the reference that opens it - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses to archive a policy a role still uses, naming the roles in the details - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#pages a list by the cursor it answered, and answers no cursor at the end - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses a cursor that is not one it issued, rather than answering an arbitrary page - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#reads a built-in by its stable key and a custom policy by its id, through one route - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#judges a set of rules without saving anything, naming each problem and the rule it is in - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#warns, without refusing, that CRM keys allowed without crm.application.access grant nothing in CRM - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers no warning for the same rules once they allow crm.application.access - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#changes a policy at the version If-Match states, and refuses the same change twice - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses a write against a built-in as read-only rather than as a record that is not there - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#copies a built-in into the customer, recording what it was copied from - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers nothing of where a policy came from when it was not copied from one - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses a body the schema does not accept, before anything is written - provenance: test source: 'services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#the roles of a customer' - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#creates a role from references and answers each policy with its own reference - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#reads a built-in role by its key, with the policies it is made of - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#lists the people who hold a role, which is whoever the caller reaches and not every customer's - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers each role row how many policies it has and how many people hold it - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#saves a role with neither policies nor rules, and answers that it grants nothing - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers the draft role as granting nothing on its own record and on its list row - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers a role made of a built-in policy as granting something, on its record and on its list row - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers a role whose only rule denies as granting nothing - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#stops answering grants-nothing once the draft is given a policy - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers a copied role where it came from, with the version copied and the version of the source today - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#pages the members of a role by the cursor it answered, each with the scope of their grant - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses to archive a role somebody still holds, naming the holders in the details - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#archives a role nobody holds, through the same route a held one is refused by - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#Rhythm's staff-only roles and policies, as a customer administrator - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#lists every role but the staff-only ones, the built-ins a customer assigns among them - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#lists every policy but the staff-only ones - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers 404 for a staff-only role and policy read by their keys, as for a role that is not there - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers 404 for the members of a staff-only role - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses to grant a staff-only role to a member, by its key or its id, and grants nothing - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses a role built from a staff-only policy, and copying a staff-only role or policy - provenance: test source: 'services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#the permission catalog' - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers the keys a rule may name, each with its tier - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#leaves the staff-only keys out for a caller who is not staff - provenance: test source: 'services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#the wall and the two keys' - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#answers 404 for a customer the caller does not reach, rather than 403 or another customer's records - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses a platform-scope caller a customer’s roles, however wide the grant it carries - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#lets a caller holding only the read key read a role, and refuses the same caller the write - provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses an anonymous call before any handler runs dependency_evidence: >- The local request harness exercises the route dispatcher and the prepared database. The file declares no substituted collaborators. evidence: - 'services-platform:modules/security/tests/e2e/definitions.e2e.spec.js' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/security/tests/e2e/definitions.e2e.spec.js' explicit_no_doubles: true identified_double_boundaries: [] --- # Definitions request checks ## Verification Boundary The file exercises public request handling through the local service harness. The assertion references identify the source checks for definitions. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The local request harness exercises the route dispatcher and the prepared database. The file declares no substituted collaborators. ## Must Not Be Doubled Keep route dispatch, signed-context verification and the exercised service decisions real. A test key can supply signatures, but replacing the authorization decision cannot prove request enforcement.