--- id: JNY-PFM-SEC-005 title: Approve and end customer workspace access for support feature: FEAT-PFM-SEC-05 product_area: platform module: security revision: 1 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f actor: ACT-PFM-005 goal: >- Obtain customer-approved access for a support task, use the workspace and revoke the grant when the task is complete. capabilities: - CAP-PFM-SEC-017 - CAP-PFM-SEC-007 - CAP-PFM-SEC-015 screens: - '/hq/tenants/{tenantId}' - '/console/{tenantId}/security/rhythmAccess' - '/console/{tenantId}' steps: - 'n': 1 surface: requestHqTenantAccess action: Request two days of Read Only from HQ with the support reason. capability: CAP-PFM-SEC-017 expected: The backend stores a waiting request without granting access and returns its notification outcome. provenance: test source: >- services-platform:modules/security/tests/e2e/approved-access.e2e.spec.js#takes the request, 200, answering it waiting for a decision with the names of what it would reach - 'n': 2 surface: '/console/{tenantId}/security/rhythmAccess' action: Approve the request as an authorized customer security administrator. capability: CAP-PFM-SEC-017 expected: The backend activates the grant for the approved duration within the request limit. provenance: test source: >- services-platform:modules/security/tests/e2e/approved-access.e2e.spec.js#approves it, 200, for the days the administrator chose - 'n': 3 surface: '/console/{tenantId}' action: Enter the workspace through HQ. capability: CAP-PFM-SEC-007 expected: The mock console displays the staff-access banner on workspace entry. provenance: test source: >- react-console:e2e/mock/hq-lists.mock.spec.ts#End Access ends the grant and returns to HQ; the tenant then asks for access again - 'n': 4 surface: revokeTenantStaffAccess action: Revoke the grant as the customer administrator. capability: CAP-PFM-SEC-017 expected: >- The backend revokes it and fresh context evaluation no longer reports reach; existing cached authority can persist. provenance: test source: >- services-platform:modules/security/tests/e2e/approved-access.e2e.spec.js#takes the access away again when the administrator revokes it alternates: - from_step: 1 condition: An incident requires the emergency path. path: Open a valid emergency grant with Rhythm Administrator authority. outcome: The backend returns the opened grant and notification outcome. provenance: test source: >- services-platform:modules/security/tests/e2e/staff-access.e2e.spec.js#opens the grant, 200, answering it with the names of what it reaches and the notice’s outcome - from_step: 3 condition: The staff member already holds standing access. path: Enter through that standing grant. outcome: The mock entry uses no emergency dialog and shows a banner without an expiry. provenance: test source: >- react-console:e2e/mock/hq-lists.mock.spec.ts#a standing grant (no expiry) enters with no dialog, and the banner names no end failures: - from_step: 2 condition: A Power User attempts to decide the request. path: Reject the decision for missing staff-access authority. outcome: The request remains waiting. provenance: test source: >- services-platform:modules/security/tests/e2e/power-user-staff-access.e2e.spec.js#leaves the request waiting after the Power User’s refused decisions - from_step: 3 condition: Staff attempt entry before any access is granted. path: The mock console offers the emergency-access dialog. outcome: >- That mock establishes dialog behavior, while staff-role authorization is established by backend emergency tests. provenance: test source: >- react-console:e2e/mock/hq-lists.mock.spec.ts#without a grant asks for emergency access, validates it, then switches in with only the tenant's navigation rules_in_play: - BR-CAP-PFM-SEC-017-01 - BR-CAP-PFM-SEC-017-02 - BR-CAP-PFM-SEC-017-03 - BR-CAP-PFM-SEC-017-04 - BR-CAP-PFM-SEC-017-06 - BR-CAP-PFM-SEC-017-07 - BR-CAP-PFM-SEC-017-13 - BR-CAP-PFM-SEC-015-04 assertions: - id: AS-JNY-PFM-SEC-005-01 statement: A waiting request does not appear as reachable workspace access in fresh evaluation. provenance: test source: >- services-platform:modules/security/tests/e2e/approved-access.e2e.spec.js#grants the staff member nothing while the request is waiting - id: AS-JNY-PFM-SEC-005-02 statement: Approval introduces the grant into fresh reachable-access evaluation. provenance: test source: >- services-platform:modules/security/tests/e2e/approved-access.e2e.spec.js#is what lets the staff member into the tenant, and only then - id: AS-JNY-PFM-SEC-005-03 statement: >- Customer revocation removes that reach from a fresh context; it does not prove immediate gateway-cache eviction. provenance: test source: >- services-platform:modules/security/tests/e2e/approved-access.e2e.spec.js#takes the access away again when the administrator revokes it e2e_policy: required e2e_reason: >- The intended journey connects a staff operator in HQ with an administrator in the customer’s Security area. Backend grants and mock banners provide separate evidence; a real browser journey must establish their combined behavior. evidence: - >- Pinned services-platform references for the structured rows: modules/security/tests/e2e/approved-access.e2e.spec.js; modules/security/tests/e2e/power-user-staff-access.e2e.spec.js; modules/security/tests/e2e/staff-access.e2e.spec.js. - 'Pinned react-console references for the structured rows: e2e/mock/hq-lists.mock.spec.ts.' proved_by: [] --- # Approve and end customer workspace access for support ## Story Support requests access for a ticket and waits while the customer administrator reviews it in Rhythm Access. After approval, the operator enters through HQ and sees the staff-access banner. The customer revokes the grant when work ends. Fresh evaluation then loses the access, subject to the separately documented cache limits.