---
id: TST-PFM-SEC-192
title: Staff customer administration database and service checks
kind: integration
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - >-
    modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js
implements:
  - ATS-PFM-SEC-012-10
  - ATS-PFM-SEC-017-12
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#Rhythm
      staff administering a customer through a customer-level standing grant: the lockout guard and
      the widening rule
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#gives
      the staff member one customer-level standing grant, in Acme alone, the premise of every case
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#the
      widening rule, for a staff member and for a customer administrator
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#lets
      staff invite a person to Acme with a custom role scoped to one of its tenants
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#lets
      staff set that role’s scope to two of Acme’s tenants
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#refuses
      the same staff member an invitation in a customer they hold no grant in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#refuses
      an Acme access manager a role granting a key they do not hold themselves
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#the
      lockout guard, in a customer with none of its own administrators
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#lets
      staff edit a role of Acme, which leaves its count of administrators at nought
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#lets
      staff archive a role of Acme, which leaves its count of administrators at nought
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#the
      lockout guard, in a customer with exactly one administrator of its own
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#refuses
      staff withdrawing that administrator’s grant, as a lockout
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#refuses
      staff taking the Security Administrator policy off the role that makes them administrator, as
      a lockout
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#leaves
      Acme with its one administrator after both refusals
dependency_evidence: >-
  The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here.
  The suite controls Cognito, message delivery, workflow execution, the signing key at the declared
  seams; those collaborators remain outside its live proof.
evidence:
  - >-
    services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: >-
    services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js
  explicit_no_doubles: false
  identified_double_boundaries:
    - Cognito
    - message delivery
    - workflow execution
    - the signing key
---
# Staff customer administration database and service checks

## Verification Boundary

The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for staff customer administration.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls Cognito, message delivery, workflow execution, the signing key at the declared seams; those collaborators remain outside its live proof.

## Must Not Be Doubled

Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.