---
id: TST-PFM-SEC-194
title: Authorize unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/authorizer/authorize.spec.ts
implements:
  - ATS-PFM-SEC-015-01
  - ATS-PFM-SEC-015-02
  - ATS-PFM-SEC-015-03
  - ATS-PFM-SEC-015-05
  - ATS-PFM-SEC-015-06
  - ATS-PFM-SEC-015-07
  - ATS-PFM-SEC-015-08
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: 'services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the authorizer'
  - provenance: test
    source: 'services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#an allowed request'
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#returns an Allow
      naming every tenant where a grant could apply, with the signed context
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the context expires
      at iat + the gateway TTL + 30 s and carries no IP address
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#asks for the grants
      of every key the route’s requirements name, including evaluates
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#lists only the
      tenants a grant could reach, not every tenant of the customer
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#on a stage whose
      gateway caches answers per workspace (rhythmAuthorizerCache = tenant, decision D1)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#decides and signs
      for the path workspace alone: the policy, the tenants and the slice name no other
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses the path
      workspace when only another workspace’s grant could allow, as a Deny for that workspace
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#keeps the
      customer-wide answer on a stage that does not say so
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#still lists a
      tenant whose assignment starts later: a cached answer must not outlive the condition
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a portal caller is
      allowed on its own tenant only
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a portal caller
      linked to a contact carries it as `cid`, and one not linked carries none
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a console caller
      carries no `cid`, whatever its identity says
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a console caller
      may use a portal-level route, because that level admits both walls
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a route that names
      no tenant is allowed once, for the caller’s customer
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#resolves the slice
      for the tenant the path names
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#resolves the slice
      for the customer a route names, and signs the context in the customer the slice answers
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a system route is
      allowed for a platform-scope assignment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#writes one decision
      line: the outcome, who, where and how long, and never a token or a sub
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the token and its
      pool
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a request
      with no token at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses an unknown
      issuer: 401, and no pool, identity or grant is read
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a
      non-Cognito issuer at the front door
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a pool that
      is not active
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a client
      the pool does not register
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a token of
      one pool presented with another pool’s issuer
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the route’s
      requirement
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a route the
      registry does not declare: a Deny the gateway may cache
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#reads a peer API’s
      routes from the registry partition of the service that API serves
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#reads a module
      API’s routes from the partition its stage names, with no entry in the peer list
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#prefers the peer
      list over a stage variable, and ignores a stage variable that is no service name
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a module
      API whose stage names a service with no published manifest
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#checks the
      authorizer’s own API against its own service, not a peer’s
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a service
      with no published manifest
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a public
      route reaching the authorizer at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#applies the
      stricter of the staged and active requirements for a route both declare
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#serves a
      last-known-good manifest while one is young enough, then fails closed as manifest_invalid
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#fails closed when
      the registry cannot be read at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the manifests read
      beside the token
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#starts reading the
      registry before the token is verified
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a token
      that fails verification for itself, though the registry cannot be read
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a token
      that fails verification for itself, though the manifests do not declare the route
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses as
      manifest_unavailable, never an Allow, when the deciding manifest cannot be read by key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses as
      manifest_invalid, never an Allow, when the deciding manifest fails validation
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses as
      manifest_invalid, never an Allow, when the deciding row’s checksum is not its document’s
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a request API
      Gateway matched with a catch-all resource
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#finds the route by
      matching the concrete path against the registry’s templates
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#allows the
      request’s own method ARN, which is the concrete path the caller asked for
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names the route’s
      own template on the decision line, never the catch-all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#matches a route
      below a prefix catch-all, where the prefix is part of the template
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#reads the tenant
      from the matched template’s own parameter, not the greedy remainder
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#drops the base path
      or stage the deployment puts in front of the request path
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#matches a route
      that names no tenant, and allows it once
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a path no
      template matches, exactly as an unregistered route, denying that path alone
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a method no
      template of that path declares
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the wall between
      console and portal
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a portal
      token on a console route before any identity is read
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a portal
      token on a system route the same way
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#never lists another
      tenant for a portal token: the gateway refuses that path, while the cached answer keeps
      serving the pool’s tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a user
      whose wall is not the pool’s
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a portal
      user of another tenant than the pool’s
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the identity and
      the user
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses an unknown
      identity with 401 and writes nothing: the authorizer never creates one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a revoked
      identity
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a suspended
      user with 401, and an invited or revoked one as inactive
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#never lists a
      tenant of another customer for a console user, and does not lock the route for its own tenants
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#admits any tenant
      to staff on a SYSTEM route, signing ANY_TENANT so the dispatcher vouches for no customer
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#admits that same
      platform-scope grant to no tenant at all on a console route, because it is authority on
      neither (rule S1)
  - provenance: test
    source: 'services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the grants'
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#returns a Deny for
      the whole route when no grant could apply anywhere
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a system
      route without a platform-scope assignment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#fails closed when
      the grants cannot be read
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a grant
      slice over 6 KB rather than truncating it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a KMS failure is
      context_unavailable: there is no Allow without a context
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a route that
      evaluates another application’s key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#resolves the grants
      of that key as well as the keys the route requires
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#signs the key and
      the rule that allows it into the context, which is what the handler reads
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#is not allowed by
      that key: a caller holding only it is denied the route
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the policy it
      returns
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#enumerates many
      tenants within the 48 KB cap, one resource each and no pattern
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#degrades to the
      path tenant when the full policy would not fit
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#what a refusal
      tells the caller (DEF-CRM-0008)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names the keys the
      route requires and the cause permission on a route Deny for a missing grant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names the cause
      tenant on an Allow, whose only refusal is a path tenant the policy does not list
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names the cause
      tenant on a portal user of another tenant than the pool’s
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names the cause
      access, never permission, when holding the key would not help (a system route without staff
      authority)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names no keys for a
      route the registry does not declare, because there are none to name
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names the refusal
      reason and the missing key, both strings, and nothing that identifies the caller
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names
      tenant_boundary for a portal user of another tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#names
      service_unregistered for a service with no published manifest, with no key to name
  - provenance: test
    source: 'services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#whatever goes wrong'
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#an event that is
      not an authorizer request at all is a 401 with one decision line
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#an undecodable
      bearer token is a 401
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a failing port is a
      refusal with its own reason, never an Allow
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the context it
      signs is the only thing that carries authority: the raw token never reaches the backend
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a custom-records
      key held at the scope of one object (PLAT-M5 D10, CO-ACC-0318 step 6)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the gateway lets
      the holder through to an object the scope does not name, so the service answers it as not
      found
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the gateway lets
      the holder through to the object the scope names
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#a key the grant
      does not carry is still refused at the gateway, whatever the object
dependency_evidence: >-
  The file exercises its imported production code with controlled inputs. Source inspection
  identifies the test entry and assertions; it does not establish a live database, provider or
  deployed workflow.
evidence:
  - 'services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts'
  explicit_no_doubles: false
  identified_double_boundaries: []
---
# Authorize unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for authorize.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The file exercises its imported production code with controlled inputs. Source inspection identifies the test entry and assertions; it does not establish a live database, provider or deployed workflow.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.