---
id: TST-PFM-TNL-095
title: Platform first administrator provisioning
kind: unit
product_area: platform
module: tenant-lifecycle
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts
implements: []
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: Own in-process inputs and any installed dependency seams; restore process state after the file.
evidence:
  - 'services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts'
  - >-
    services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts imports
    ../../../../../security/db/security-assignments.table
  - >-
    services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts imports
    ../../../../../security/db/users.table
  - >-
    services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts imports
    ../../../../services/lifecycle/first-administrator
binding_scope: >-
  No complete ATS or FAS scenario implementation is claimed for this file. Partial assertions, if present,
  remain evidence rather than implements links.
partial_scenario_evidence:
  - scenario: ATS-PFM-TNL-004-02
    references:
      - >-
        services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#grants the
        built-in Administrator role, by the product key the catalog publishes it under
    provenance: test
    scope: partial assertions; no complete scenario implementation claimed
  - scenario: ATS-PFM-TNL-004-04
    references:
      - >-
        services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses a
        SUSPENDED user, whatever they hold: an administrator nobody can use is none
      - >-
        services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses
        when the grant is of another role, which administers nothing
      - >-
        services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses
        when the Administrator grant is at tenant scope rather than the customer’s own
      - >-
        services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses a
        grant that has already ended
    provenance: test
    scope: partial assertions; no complete scenario implementation claimed
---
# Platform first administrator provisioning

## Verification Boundary

The suite calls policy, mapping, manifest or dependency-injected code in process. Its assertions establish the named local behavior without a deployed API or a migrated cross-application workflow.

## What This Suite Proves

First administrator provisioning is the inspected subject. The inspected engineering checks remain available in the register. Some may contribute partial assertions to capability scenarios, but the file is not claimed to implement any complete scenario; the unbound inventory records that remaining mapping work.

## What It Does Not Prove

Source inspection supplies no passing run. The suite does not establish console behavior, deployment configuration, complete removal in every application or recovery from a provider failure beyond its declared seams. A local zero inventory covers declared and seeded resources only.

## Real Dependencies and Test Doubles

The source uses in-process policy and manifest inputs, and dependency seams where declared. Imported libraries are part of the exercised code; collaborator answers do not establish database enforcement or provider behavior.

## Must Not Be Doubled

Keep the policy, mapper, declaration or formatting function named by the source real; do not replace its return value with the expected answer. Any future database or API qualification must add the real boundary separately.