The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.
| # | Surface | Action | Capability | Expected | Provenance |
|---|---|---|---|---|---|
| 1 | Platform security roles | Assign preparer and approver policies to separate people and Accounting access alone to another. | CAP-ACC-REC-020 | Preparation supplies thirteen keys including application access, and approval adds four sensitive grants. | test |
| 2 | listPayouts | Attempt payout inspection with application access alone. | CAP-ACC-REC-020 | Record read authorization fails. | test |
| 3 | getPayout | Inspect payout and explanation records using a read-only role. | CAP-ACC-REC-004 | Inspection offers no write action and write attempts are forbidden. | test |
| 4 | createPayout | Prepare a deposit in another business unit. | CAP-ACC-REC-001 | Workspace grants allow preparation there without granting sensitive approvals. | test |
| 5 | finalizeReconciliationBatch | Approve the preparer’s explanation using the separate approver. | CAP-ACC-REC-011 | Eligible independent finalization succeeds. | test |
| 6 | createPayout | Retry keyed money requests and use the same key text as another person. | CAP-ACC-REC-020 | Original calls replay while a colleague’s key is scoped as a separate request. | test |
| Path | From step | Condition | Path taken | Outcome | Provenance |
|---|---|---|---|---|---|
| alternate | 5 | The workspace represents the second-person requirement as disabled. | Finalize as the preparer with the waiver retained. | Current product administration cannot set that waiver. | unknown |
| failure | 5 | The intended approver previously claimed money in the draft. | Reject finalization under the preparation guard. | Another eligible approver must complete the decision. | test services-accounting:modules/reconciliation/tests/integration/services/batch-lifecycle/finalize-batch.integration.spec.js#refuses a person who claimed items in it |
| Id | Statement | Provenance |
|---|---|---|
01 | Preparation policy grants ordinary work and approval policy adds the four sensitive decisions. | test |
02 | Keyed financial requests replay unchanged bodies and refuse changed requests. | test |
03 | Permission grants cover the workspace without unit-specific restrictions. | test |
End-to-end policy: required: Browser coverage is needed to establish the staff workflow across screens; separate API evidence supports the financial and permission decisions.