The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.
| # | Surface | Action | Capability | Expected | Provenance |
|---|---|---|---|---|---|
| 1 | /console/{tenantId}/configuration/accounting/businessUnits | Enter Accounting configuration with the reader persona. | CAP-ACC-BKS-016 | The permitted configuration areas can be opened. | test |
| 2 | /console/{tenantId}/configuration/accounting/businessUnits | Inspect a unit and its posting defaults. | CAP-ACC-BKS-001 | The records are readable and the unit editor permits inspection only. | test |
| 3 | /console/{tenantId}/configuration/accounting/glAccounts | Review chart, receiving accounts, dimensions and terms. | CAP-ACC-BKS-005 | The lists load without functioning write actions. | test |
| 4 | /console/{tenantId}/configuration/accounting/fiscalYears | Inspect years and current-period lookup. | CAP-ACC-BKS-009 | Calendar reads succeed without generation, rename or delete actions. | test |
| 5 | /console/{tenantId}/configuration/accounting/documentTemplates | Inspect template content, preview and merge vocabulary. | CAP-ACC-BKS-014 | The content is readable and previewable but cannot be saved. | test |
| Path | From step | Condition | Path taken | Outcome | Provenance |
|---|---|---|---|---|---|
| failure | 3 | The reader bypasses controls and submits service mutations. | Resource permission checks refuse each write. | No record is added, changed or removed. | test services-accounting:modules/books/tests/e2e/configuration-security.e2e.spec.js#leaves the unit as it was after the refusals |
| Id | Statement | Provenance |
|---|---|---|
01 | Every permitted configuration read remains accessible. | test |
02 | Attempted mutations receive refusals and leave saved data intact. | test |
03 | The review exposes no records from another workspace. | test |
End-to-end policy: required: The browser must demonstrate that permissions govern controls on every reviewed screen.