---
id: TST-PFM-SEC-190
title: Open emergency access database and service checks
kind: integration
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - >-
    modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js
implements:
  - ATS-PFM-SEC-017-01
  - ATS-PFM-SEC-017-07
  - ATS-PFM-SEC-017-09
  - ATS-PFM-SEC-017-10
  - ATS-PFM-SEC-017-11
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#staff
      access capability: emergency access to a customer tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#opening
      emergency access
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#stores
      an active emergency grant for the caller, from now for the duration asked
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#materializes
      an active tenant-scoped assignment of the role in that tenant, ending when the grant does
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#writes
      a widening security audit event on the tenant’s customer and tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#e-mails
      each of the tenant’s administrators who, which tenant, which role, why, the ticket and until
      when
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#answers
      the names of what the grant reaches
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a second grant into the same tenant 409, naming the grant already held
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#lists
      the grant among the caller’s active grants, with the tenant, customer and role names
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#a
      delivery that fails
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#still
      opens the grant, and reports the notice as failed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#the
      staff security list
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#e-mails
      the staff security list beside the tenant’s administrators, in the staff’s words
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#e-mails
      an address on both lists once, as the tenant’s administrator
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#the
      request’s safeguards
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a reason shorter than twenty characters
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a missing ticket reference
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a duration of no minutes
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a duration past four hours, which is never extended
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a staff role, which is no role a tenant uses
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a role that does not exist with the same sentence
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#who
      may open emergency access
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a member of Rhythm’s staff whose role does not carry hq.emergency-access.use
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a Software Engineer, whose HQ reader keys and custom query table keys do not carry
      hq.emergency-access.use
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a customer’s own Administrator, who is not staff
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#the
      assignments wall (migration 0073)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a staff member’s tenant-scoped assignment into another customer that no grant names
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#admits
      the same assignment when an active grant names it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      it when the grant naming it has already been revoked
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      the assignment of somebody who is not Rhythm staff into another customer, though an active
      grant names it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a staff member’s assignment into another customer when the active grant names a different
      assignment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      an emergency grant longer than four hours in the database too, so no writer can extend one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a standing grant with an expiry, and any other grant without one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a grant naming somebody who is not a member of Rhythm’s staff
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#the
      console’s amendment of a grant’s assignment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      Acme’s administrator, for whom the staff member is no console user of their customer
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      a Rhythm administrator managing Rhythm’s own console users, because the window is the grant’s
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#a
      grant that has expired
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#gives
      no access: the evaluator refuses the role’s keys in that tenant over the assignment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#gave
      access before it expired, which is the premise of the case above
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#is
      no longer among the caller’s active grants, and is stored as expired
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#cannot
      be ended, having ended already
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#ending
      a grant early
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#stores
      the grant as revoked, by the caller, then
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#revokes
      the assignment, so the access ends with it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#writes
      the end on the security trail
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#submits
      an authorizer-cache flush naming the grant, so a cached answer does not outlive the access
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#answers
      another staff member’s grant id 404, as one that does not exist
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#ending
      a standing grant of one’s own
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      it 409 staff_access_grant_standing, naming the grant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#says
      where standing access ends instead
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#leaves
      the standing grant active and unrevoked
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#leaves
      its assignment active
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#submits
      no authorizer-cache flush for the grant, as an emergency grant’s end does
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#the
      security context of a staff member holding a grant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#offers
      the granted tenant, marked with the grant, its expiry and its role
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#does
      not offer the customer’s other tenant, which no grant reaches
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#answers
      the granted tenant with exactly the keys the role gives the customer’s own Administrator there
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#includes
      the Security area’s read keys among them
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#refuses
      the customer’s other tenant by path
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#what
      a customer’s administrator sees of grants
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#shows
      the grant on the trail of the customer whose tenant it reaches
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#never
      shows it on another customer’s trail
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js#never
      offers it in that other customer’s administrator’s security context
dependency_evidence: >-
  The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here.
  The suite controls the clock at the declared seams; those collaborators remain outside its live
  proof.
evidence:
  - >-
    services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: >-
    services-platform:modules/security/tests/integration/services/staff-access/open-emergency-access.integration.spec.js
  explicit_no_doubles: false
  identified_double_boundaries:
    - the clock
---
# Open emergency access database and service checks

## Verification Boundary

The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for open emergency access.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls the clock at the declared seams; those collaborators remain outside its live proof.

## Must Not Be Doubled

Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.