--- id: FAS-PFM-SEC-01 title: Customer and Workspace Administration acceptance feature: FEAT-PFM-SEC-01 product_area: platform module: security revision: 2 status: proposed product_intent: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f capabilities: - CAP-PFM-SEC-001 - CAP-PFM-SEC-002 - CAP-PFM-SEC-003 - CAP-PFM-SEC-004 scenarios: - id: FAS-PFM-SEC-01-01 title: Set up and hand over one customer workspace kind: behaviour exercises: - CAP-PFM-SEC-001 - CAP-PFM-SEC-002 - CAP-PFM-SEC-003 relies_on: - ATS-PFM-SEC-001-02 - ATS-PFM-SEC-002-01 - ATS-PFM-SEC-003-04 preconditions: >- Reserve unused customer and workspace references and prepare authorized staff and a customer administrator. steps: - do: >- Submit setup, complete the enabled provisioning work and read the saved customer and workspace under customer authority. expect: >- One active workspace belongs to the intended customer and is reachable by its administrator; repeating the submission returns the same setup result. provenance: proposed source: - >- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a body that names no id as 400 customer_id_required, nothing generating one - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#lists no tenant of another customer, which is what the reach reduction means - >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers a tenant that is not usable yet, because the work has only been asked for expected: >- One active workspace belongs to the intended customer and is reachable by its administrator; repeating the submission returns the same setup result. negative: false data_needs: >- Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case. bound_to: [] provenance: proposed source: - >- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a body that names no id as 400 customer_id_required, nothing generating one - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#lists no tenant of another customer, which is what the reach reduction means - >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers a tenant that is not usable yet, because the work has only been asked for action_evidence: provenance: proposed source: - >- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a body that names no id as 400 customer_id_required, nothing generating one - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#lists no tenant of another customer, which is what the reach reduction means - >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers a tenant that is not usable yet, because the work has only been asked for assertion_evidence: provenance: proposed source: - >- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a body that names no id as 400 customer_id_required, nothing generating one - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#lists no tenant of another customer, which is what the reach reduction means - >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers a tenant that is not usable yet, because the work has only been asked for execution_gap: FND-PFM-SEC-078 - id: FAS-PFM-SEC-01-02 title: Loading suspends ordinary work until activation kind: interaction exercises: - CAP-PFM-SEC-002 - CAP-PFM-SEC-003 relies_on: - ATS-PFM-SEC-002-09 - ATS-PFM-SEC-003-11 - ATS-PFM-SEC-003-13 preconditions: Prepare an active implementation workspace with separate loading and activation identities. steps: - do: >- Start the initial load, issue an ordinary request, finish loading and activate using the identity allowed to do so. expect: >- Ordinary work is refused during loading and becomes available after activation; business status stays in implementation. provenance: proposed source: - >- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key expected: >- Ordinary work is refused during loading and becomes available after activation; business status stays in implementation. negative: true data_needs: >- Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case. bound_to: [] provenance: proposed source: - >- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key action_evidence: provenance: proposed source: - >- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key assertion_evidence: provenance: proposed source: - >- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key execution_gap: FND-PFM-SEC-078 - id: FAS-PFM-SEC-01-03 title: Cancel retirement without re-enabling a disabled workspace kind: lifecycle exercises: - CAP-PFM-SEC-002 - CAP-PFM-SEC-004 relies_on: - ATS-PFM-SEC-002-03 - ATS-PFM-SEC-004-02 - ATS-PFM-SEC-004-07 preconditions: Prepare a disabled workspace with active lifecycle and no dependency that blocks retirement. steps: - do: >- Submit a retirement request, place it on hold and cancel before destruction; read the workspace and retained request. expect: >- Cancellation restores active lifecycle, preserves disabled business status and remains visible on the request. provenance: proposed source: - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#leaves the lifecycle state where the server put it after such a patch - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is still live, because people must lose access first - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#returns the tenant to active expected: >- Cancellation restores active lifecycle, preserves disabled business status and remains visible on the request. negative: false data_needs: >- Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case. bound_to: [] provenance: proposed source: - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#leaves the lifecycle state where the server put it after such a patch - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is still live, because people must lose access first - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#returns the tenant to active action_evidence: provenance: proposed source: - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#leaves the lifecycle state where the server put it after such a patch - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is still live, because people must lose access first - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#returns the tenant to active assertion_evidence: provenance: proposed source: - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#leaves the lifecycle state where the server put it after such a patch - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is still live, because people must lose access first - >- services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#returns the tenant to active execution_gap: FND-PFM-SEC-078 - id: FAS-PFM-SEC-01-04 title: Customer administration cannot cross staff-only setup boundaries kind: permission exercises: - CAP-PFM-SEC-001 - CAP-PFM-SEC-002 - CAP-PFM-SEC-003 - CAP-PFM-SEC-004 relies_on: - ATS-PFM-SEC-001-01 - ATS-PFM-SEC-002-02 - ATS-PFM-SEC-003-01 - ATS-PFM-SEC-004-01 preconditions: Prepare a customer administrator and authorized staff against disposable records. steps: - do: >- Attempt customer creation, workspace status changes, setup and retirement as the customer identity; exercise the permitted staff paths on separate records. expect: >- Customer authority is refused at the staff-only boundaries and produces none of the attempted staff-controlled changes. provenance: proposed source: - >- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a customer-scoped caller the system route that creates a customer - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a customer administrator the same change on the console route, naming where it is made - >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not ask for a tenant at all - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not ask for a tenant to be deleted expected: >- Customer authority is refused at the staff-only boundaries and produces none of the attempted staff-controlled changes. negative: true data_needs: >- Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case. bound_to: [] provenance: proposed source: - >- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a customer-scoped caller the system route that creates a customer - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a customer administrator the same change on the console route, naming where it is made - >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not ask for a tenant at all - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not ask for a tenant to be deleted action_evidence: provenance: proposed source: - >- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a customer-scoped caller the system route that creates a customer - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a customer administrator the same change on the console route, naming where it is made - >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not ask for a tenant at all - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not ask for a tenant to be deleted assertion_evidence: provenance: proposed source: - >- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a customer-scoped caller the system route that creates a customer - >- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a customer administrator the same change on the console route, naming where it is made - >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not ask for a tenant at all - >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not ask for a tenant to be deleted execution_gap: FND-PFM-SEC-078 - id: FAS-PFM-SEC-01-05 title: Setup replay and competing retirement actions retain one decision kind: regression exercises: - CAP-PFM-SEC-003 - CAP-PFM-SEC-004 relies_on: - ATS-PFM-SEC-003-03 - ATS-PFM-SEC-004-03 - ATS-PFM-SEC-004-09 preconditions: >- Prepare a disposable setup submission and a retirement fixture with a controllable destruction boundary. steps: - do: >- Repeat setup, submit competing retirement requests and start cancellation concurrently with destruction. expect: >- Setup replay retains one result and retirement retains one open request; cancellation cannot restore a workspace once destruction owns the decision. provenance: proposed source: - >- services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#answers the same tenant and the same job when the same submission is sent twice - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a second request, naming the one that is open - >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses the cancel as already executing in every round destruction won expected: >- Setup replay retains one result and retirement retains one open request; cancellation cannot restore a workspace once destruction owns the decision. negative: true data_needs: >- Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case. bound_to: [] provenance: proposed source: - >- services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#answers the same tenant and the same job when the same submission is sent twice - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a second request, naming the one that is open - >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses the cancel as already executing in every round destruction won action_evidence: provenance: proposed source: - >- services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#answers the same tenant and the same job when the same submission is sent twice - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a second request, naming the one that is open - >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses the cancel as already executing in every round destruction won assertion_evidence: provenance: proposed source: - >- services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#answers the same tenant and the same job when the same submission is sent twice - >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a second request, naming the one that is open - >- services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#refuses the cancel as already executing in every round destruction won execution_gap: FND-PFM-SEC-078 evidence: - >- specs/platform/security/planning/capabilities/CAP-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md - >- specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md - >- specs/platform/security/planning/capabilities/CAP-PFM-SEC-003-provision-a-workspace-and-bring-it-into-service.md - >- specs/platform/security/planning/capabilities/CAP-PFM-SEC-004-retire-a-workspace-through-a-deliberate-reversible-deletion.md - >- Capability test scenario references identify the outcomes this suite relies on. The complete feature chains remain proposed until a suite executes every step. examiner: codex examined_at: '2026-10-23' final_text: OpenAI --- # Customer and Workspace Administration acceptance: Feature Acceptance Suite ## What the Feature Must Do as a Whole The suite follows a customer from staff setup into an available workspace, then through loading and a retirement decision. Its cases connect administration records to the work that customer users can perform. ## Interactions Between Capabilities Loading, cancellation and retirement change availability through different records. The suite checks their handoffs while keeping the workspace’s business status separate from its readiness. The referenced capability scenarios supply detailed observations. These ordered feature cases remain proposed until a registered suite executes the whole chain and its result is retained. ## Regression Record | Revision | Change | Scenario | Why | |---|---|---|---| | 1 | initial | all | Establish the feature’s cumulative acceptance baseline. | | 2 | testing examination continuation | all | Verify references, write final feature text and keep execution gaps explicit. |