---
id: TST-PFM-SEC-199
title: Security context unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/services/access/security-context.spec.ts
implements:
  - ATS-PFM-SEC-007-13
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: the document as a whole
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      the whole document a customer-scope Read Only grant produces
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#falls
      back to the customer's id when the customer record names nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      a null display name rather than leaving the property out
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: which keys are allowed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      exactly the catalog keys the grant names, and no others
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#lets a
      deny win over an allow of the same key, whichever grant carries it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#reports
      the deny pattern that produced it, before the allows
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      a staff member's `allow *` in hq, and nothing at all in the console's own permissions (rule
      S1)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#still
      shows the staff grant in roles, because a screen says what somebody holds even where it does
      not apply
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      a staff member's own customer-scope grant as allowed, as it does anybody else's
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      a staff-only key to nobody who is not staff, however wide their own grant is
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      nothing from a grant whose validity has ended
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      nothing from a grant whose validity has not begun
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      nothing from a grant that is still pending acceptance
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      a key in the tenant a tenant-scoped grant names
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      nothing in another tenant of the same customer, where that grant does not reach
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      no key at all from a resource-scoped grant, which allows one record and not the tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#still
      reports that resource-scoped grant among the roles, where a screen can see it for what it is
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#lists
      the keys of a resource-scoped grant in scoped, with the resource it allows them on
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#leaves
      a key out of scoped when the caller also holds it tenant-wide, where allowed already says so
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      the application of keys held only on some resources, where the screens about those resources
      live
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      an empty scoped to a caller whose grants are all tenant-wide
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      nothing to a caller with no assignments at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      no applications and no rules to a caller with no assignments at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: which tenant is evaluated
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#lists
      the reachable tenants by name, not by id
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#evaluates
      the first reachable tenant by name when nothing is preferred
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#evaluates
      the preferred tenant when the caller reaches it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#ignores
      a preferred tenant out of reach and falls back to the default
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#lists
      only the tenants a tenant-scoped grant reaches, not every tenant of the customer
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#lists
      no tenant, and evaluates none, for a caller who reaches none
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#evaluates
      the tenant the path names when the caller reaches it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#refuses
      a path tenant of another customer that the caller's grants do not reach
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#refuses
      a path tenant that does not exist with the same sentence, saying nothing about which ids are
      real
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#refuses
      staff another customer's tenant without a tenant access grant, whatever their platform-scope
      grant (rule S4)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#lists
      only the staff member's own customer's tenants in the switcher when they hold no grant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      a customer’s own person only the tenants that are usable, leaving out one still being
      provisioned
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#never
      makes a tenant that is not usable the default tenant of a customer’s own person
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#refuses
      a customer’s own person the tenant they name in the path while it is still being provisioned
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      staff every tenant they reach, including one still being provisioned, each saying what it is
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#marks a
      holder of an in-force platform-scope grant as staff
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#marks a
      holder of an expired platform-scope grant as nobody special
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: which applications follow
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#names
      an application the caller holds a key of by the registry’s name
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#names
      no application whose keys are all denied
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#keeps
      an unknown application’s key as its own name rather than inventing one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      an empty feature list, because nothing grants a feature yet
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: what the licence mode changes
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      an application the tenant may not use while the mode is shadow, because nobody’s access has
      changed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      the keys of that application while the mode is shadow, as the request itself is still served
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      an application the tenant may not use while the mode is off, as an unset variable gives
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#allows
      the keys of that application while the mode is off
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#leaves
      out an application the tenant may not use once the mode is enforce
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#keeps
      an application the tenant may use and the person holds the access key for
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#leaves
      out an application the tenant may use when the person holds no access key for it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#keeps
      an exempt application whatever the tenant’s record says, so a blocked person can still read
      this document
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: an application with no permissions yet
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#has no
      key of it in the catalog it is judged against, which is what the rule is about (premise)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      it, by the registry’s name, to a person who holds no key of it in a tenant it is licensed in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not offer it in a tenant whose licence record does not name it, which is how a licence is
      withheld
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not offer it in a tenant the record licenses nothing in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      it whatever the record says while the mode is shadow, because shadow takes nothing away
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      it whatever the record says while the mode is off, as an unset variable gives
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      only the registry’s applications, never one a tenant’s record names and the registry does not
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not offer `hq`, which is the staff application and has no registry row a licence could name
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      none of them where no tenant is evaluated, because a licence is held in a tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#lists
      the licensed ones with the keys the caller holds, in key order and under the registry’s names
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#asks
      for the access key again once the application has permissions of its own
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      it to the person who holds that access key, which is the rule it hands back to
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: whether the caller holds any access at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#counts
      an active grant of a built-in role
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#counts
      an active grant of a custom role that allows one key and nothing else
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#counts
      an active assignment that names no role and carries only its own rules
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#counts
      an active assignment at a resource scope, which allows no key of the tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#counts
      an active assignment whose validity window has closed, which an administrator still granted
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not count an active grant whose validity window has not opened yet, which grants nothing
      before it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#counts
      the same grant from the instant its window opens
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not count an assignment that is still pending acceptance
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not count a revoked assignment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not count the derived grant of reading yourself, which every authenticated caller holds
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      false for a caller with no assignments at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#counts
      the one active assignment beside a pending and a revoked one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#refuses
      such a caller as access denied, which the transport answers 403
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#names
      the refusal with the code the authorizer used, which the console reads as no access
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#carries
      that code to the wire, where the shared response answers it as `code`
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#names
      no user, no organization and no grant in what it says
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: the sign-in stamp never breaks the read
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      rather than raising when the stamp cannot be written, and says in the log which user it was
      about
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#writes
      nothing for an unattended job acting for the person, the report renderer’s boot call (the case
      above is its control)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#raises
      from the write itself, so the case above is about something that really failed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: the sign-in stamp is not attempted inside the window
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#attempts
      the write for a stamp older than the window, the premise of the case below
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#opens
      no transaction for a stamp inside the window
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#attempts
      the write for a person never stamped
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      due for a stamp exactly one window old, as the statement does
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      not due one millisecond inside the window
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers
      due for no stamp at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      security context: a tenant reached through a tenant access grant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      the granted tenant beside the own customer’s, marked with the grant, its expiry and its role
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#offers
      a standing grant’s tenant with no expiry and its kind, so the console shows none and skips the
      dialog
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#evaluates
      the granted tenant by path with what the grant’s role allows there, and nothing of the
      platform grant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#neither
      offers nor enters the tenant once the grant’s window has closed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#refuses
      the granted tenant by path once the grant’s window has closed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not offer a granted tenant that is not open, which the availability gate would refuse
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not offer a tenant named by a grant whose assignment is not in the slice
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#the
      tenant reach: a caller’s relationship with a tenant that is not open
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not reach a member’s disabled tenant now
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#relates
      a member to their disabled tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#relates
      no tenant to a caller whose grants name none of it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#does
      not reach another customer’s disabled tenant through a standing grant now
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#relates
      staff to another customer’s disabled tenant through a standing grant
dependency_evidence: >-
  The file exercises its imported production code with controlled inputs. Source inspection
  identifies the test entry and assertions; it does not establish a live database, provider or
  deployed workflow.
evidence:
  - 'services-platform:modules/security/tests/unit/services/access/security-context.spec.ts'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/services/access/security-context.spec.ts'
  explicit_no_doubles: false
  identified_double_boundaries: []
---
# Security context unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for security context.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The file exercises its imported production code with controlled inputs. Source inspection identifies the test entry and assertions; it does not establish a live database, provider or deployed workflow.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.