---
id: TST-PFM-SEC-215
title: Rule validation unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/services/persistence/rule-validation.spec.ts
implements:
  - ATS-PFM-SEC-012-03
  - ATS-PFM-SEC-012-04
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#the
      rules a custom policy or a role’s inline rules may carry
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#the
      shape every rule must have
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#accepts
      a rule naming one exact key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#accepts
      a rule naming the most keys a rule may name
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      a rule naming no permission, which would say nothing at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      a rule whose permissions are missing altogether
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      one key more than a rule may name, because beyond that it is a policy rather than a rule
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      an empty string among the permissions
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      a permission that is only whitespace, which no key ever is
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      a permission that is not a string at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      the same permission named twice, which is a mistake worth naming rather than absorbing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#accepts
      a rule carrying a condition the evaluator can read
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      a condition the evaluator could only read as UNKNOWN
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      by the error class the API answers a bad request with
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#judging
      a set of rules against the catalog
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#finds
      nothing wrong with an allow of exact active keys and a deny of a pattern
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#finds
      nothing wrong with an empty set of rules, which asks nothing of the catalog
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#allows
      a staff-only key to be NAMED, because what a rule may grant is the widening rule’s question
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#a
      permission that names nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#names
      the key the catalog does not have, and the rule it is in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      an unknown key in a DENY too, because a deny nobody matches takes nothing away
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#names
      every unknown key of one rule together, rather than stopping at the first
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      a pattern no grammar reads, in a deny where a pattern is otherwise allowed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#accepts
      a deny pattern that matches no key today, because a pattern is a shape rather than a key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#a
      pattern where only an exact key is allowed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      a pattern in an allow, naming the patterns rather than the whole rule
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#refuses
      the lone star in an allow, which would grant whatever Rhythm ships next
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#accepts
      every one of those patterns as a DENY, which can only ever take more away
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#reports
      a pattern in an allow as BOTH a pattern and an unknown key when it reads as neither
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#answering
      every problem at once
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#answers
      every problem of every rule, so the editor shows them together
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#answers
      a rule that is wrong in two ways as two problems against the one index
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#reports
      a rule the shape itself refuses as one problem, and judges its keys no further
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#keeps
      judging the rules after one the shape refused, so the editor is not told one problem at a time
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#strips
      the error class from a shape refusal, because the message is what a screen shows
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#warning
      that an application’s keys grant nothing without its access key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#warns
      about a rule allowing CRM keys when no rule of the set allows crm.application.access
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#does
      not warn when another rule of the same set allows the access key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#does
      not warn about platform keys, which have no application access step
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#does
      not warn about a deny, which takes away whether or not the application is held
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#does
      not count a deny of the access key as allowing it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#warns
      once per application of a rule, naming each application’s keys apart
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts#judges
      no rule the shape refuses, which is already a problem of its own
dependency_evidence: >-
  The production function, schema or declaration runs over literal inputs. The source declares no
  substituted collaborator; this is an in-process decision or mapping check.
evidence:
  - 'services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/services/persistence/rule-validation.spec.ts'
  explicit_no_doubles: true
  identified_double_boundaries: []
---
# Rule validation unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for rule validation.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The production function, schema or declaration runs over literal inputs. The source declares no substituted collaborator; this is an in-process decision or mapping check.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.