Coverage distinguishes specified cases from executable assertions. A category marked covered has at least one case; the detailed rule, transition, permission, invariant and workflow records retain incomplete obligations as findings. Bound cases describe inspected tests and make no claim that this examination runs those tests.
Proof obligation 1: Every query call uses that person's identity — named executable assertions.
Proof obligation 2: The signed-in user supplies read authority — named executable assertions.
Proof obligation 3: Owner authority is not substituted for the requester — named executable assertions.
Proof obligation 4: The API returns a permission refusal without empty results — named executable assertions.
Proof obligation 5: Contact query access fails independently of invoice access — named executable assertions.
Proof obligation 6: The start is accepted and the evaluation later reports the permission failure — named executable assertions.
Proof obligation 7: Submission is refused rather than using another person — named executable assertions.
Proof obligation 8: Contact facts are queried through the person-based entry point — named executable assertions.
Proof obligation 9: The screen presents the refusal rather than an empty audience — named executable assertions.
Proof obligation 10: Limits are applied and invalid field batches or responses become faults — named executable assertions.
Review an audience's current reach: a combined scenario changes one capability and observes the other’s outcome.
Obtain a complete audience count in the background: a combined scenario changes one capability and observes the other’s outcome.
Maintain an accountable audience owner: a combined scenario changes one capability and observes the other’s outcome.
Enforce Marketing access and workspace boundaries: a combined scenario changes one capability and observes the other’s outcome.
Workflow cases also examine attribution, retained source inputs and workspace boundaries where the calculation or mutation crosses another capability. Each case names the capabilities it exercises and the rules it proves in its structured record.
Coverage
Rulecovered
Transitionnot-applicable
Validationcovered
Permissioncovered
Edgegap: FND-MKT-MKT-060
Failurecovered
Boundarycovered
Concurrencygap: FND-MKT-MKT-060
Invariantcovered
Interactioncovered
Test Scenarios
17 scenarios proving CAP-MKT-MKT-010; 11 bound to an existing test.
01Every query call uses that person's identityruleunittest
[
{
"do": "Inspect all query-service calls made during evaluation.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#is the person given: every call to Platform is made as them"
}
]
Expected
Every query call uses that person's identity.
Data
Use the isolated fixtures defined by the bound suite.
The signed-in requester differs from the audience owner.
Steps
[
{
"do": "Preview and inspect query calls.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/integration/services/audience-evaluation.integration.spec.ts#runs every read as the signed-in user, not as the audience’s owner"
}
]
Expected
The signed-in user supplies read authority.
Data
Prepare audience and membership rows with in-process doubles for external record reads.
The owner can query a dataset that the count requester cannot.
Steps
[
{
"do": "Run the count task.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/integration/services/count-everyone-job.integration.spec.ts#does not run as the audience’s owner, who may query the dataset, in its place"
}
]
Expected
Owner authority is not substituted for the requester.
Data
Prepare audience and membership rows with in-process doubles for external record reads.
The caller can view audiences but cannot query contacts.
Steps
[
{
"do": "Request a contacts preview.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#refuses a person who may not query contacts with a 403, never an empty audience"
}
]
Expected
The API returns a permission refusal without empty results.
Data
Use suite-created audience, list and contact fixtures with a Platform query double.
The caller can query invoices but cannot query their referenced contacts.
Steps
[
{
"do": "Evaluate the invoice audience.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#refuses a person who may query the invoices but not the contacts they point at"
}
]
Expected
Contact query access fails independently of invoice access.
Data
Use the isolated fixtures defined by the bound suite.
[
{
"do": "Start a count and read its later settlement.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#answers a count by a person who may not query the dataset 202, then reads it back failed with Platform’s code, never counted"
}
]
Expected
The start is accepted and the evaluation later reports the permission failure.
Data
Use suite-created audience, list and contact fixtures with a Platform query double.
[
{
"do": "Invoke the count starter.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/unit/count-everyone-job.spec.ts#refuses a submission that names no requester"
}
]
Expected
Submission is refused rather than using another person.
Data
Use the isolated fixtures defined by the bound suite.
[
{
"do": "Evaluate the list and inspect query calls.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#reads the contacts as the person, even though the list is Marketing’s"
}
]
Expected
Contact facts are queried through the person-based entry point.
Data
Use the isolated fixtures defined by the bound suite.
The mock-backed console receives an evaluation permission refusal.
Steps
[
{
"do": "Request preview as the insufficiently authorized viewer.",
"provenance": "test",
"source": "react-console:e2e/mock/marketing-audiences.mock.spec.ts#is shown as a message, never as an empty audience, when the person may not query the records"
}
]
Expected
The screen presents the refusal rather than an empty audience.
Data
Use the console Marketing fixtures and mocked request handlers.
A controlled Lambda client captures query requests and supplies invalid answers.
Steps
[
{
"do": "Exercise oversized page, count and field requests and malformed responses.",
"provenance": "test",
"source": "services-marketing:modules/marketing/tests/unit/marketing-record-ids.spec.ts#holds a page to Platform’s 1,000 records, so an out-of-range request is never made"
}
]
Expected
Limits are applied and invalid field batches or responses become faults.
Data
Use the isolated fixtures defined by the named source suites.
A requester can query invoices but cannot query contact facts; the audience selects the second address.
Steps
[
{
"do": "Preview the invoice audience as that requester.",
"provenance": "proposed",
"source": [
"services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#does not fall back to the primary address when the second slot is empty",
"services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#refuses a person who may query the invoices but not the contacts they point at"
]
}
]
Expected
The preview reports the contact-query refusal without returning an address or a zero total.
Data
Create the named records in a run-owned workspace; use a controllable query dependency and retain versions between steps.
Source
services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#does not fall back to the primary address when the second slot is empty,services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#refuses a person who may query the invoices but not the contacts they point at
12An exclusion read retains the requesting personinteractionapinegativeproposed
An audience subtracts another audience; the requester lacks access to the subtracted source.
Steps
[
{
"do": "Evaluate the enclosing audience as that requester.",
"provenance": "proposed",
"source": [
"services-marketing:modules/resolution/tests/unit/resolve-recipients.spec.ts#excludes with `contact_missing` an alias whose survivor does not exist",
"services-marketing:modules/marketing/services/evaluation/evaluate-audience.ts:excludedContactIds",
"services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#is the person given: every call to Platform is made as them",
"services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#refuses a person who may query the invoices but not the contacts they point at"
]
}
]
Expected
Evaluation fails with the source-query refusal rather than treating the exclusion as empty.
Data
Create the named records in a run-owned workspace; use a controllable query dependency and retain versions between steps.
Source
services-marketing:modules/resolution/tests/unit/resolve-recipients.spec.ts#excludes with `contact_missing` an alias whose survivor does not exist,services-marketing:modules/marketing/services/evaluation/evaluate-audience.ts:excludedContactIds,services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#is the person given: every call to Platform is made as them,services-marketing:modules/marketing/tests/unit/evaluate-audience.spec.ts#refuses a person who may query the invoices but not the contacts they point at
13A refused requester leaves the earlier preview intactinteractionapinegativeproposed
Maya has successfully previewed an audience; Ben lacks its source-query authority.
Steps
[
{
"do": "Ben previews the same audience and read its stored history and summary afterward.",
"provenance": "proposed",
"source": [
"services-marketing:modules/marketing/services/evaluation/audience-evaluations.ts:recordFailure",
"services-marketing:modules/marketing/tests/integration/services/audience-evaluation.integration.spec.ts#leaves the audience’s version alone, so an editor’s next save is not stale",
"services-marketing:modules/marketing/tests/integration/services/audience-evaluation.integration.spec.ts#runs every read as the signed-in user, not as the audience’s owner",
"services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#refuses a person who may not query contacts with a 403, never an empty audience"
]
}
]
Expected
Ben receives a refusal; a failed evaluation has no counts and Maya’s earlier summary remains intact.
Data
Create the named records in a run-owned workspace; use a controllable query dependency and retain versions between steps.
Source
services-marketing:modules/marketing/services/evaluation/audience-evaluations.ts:recordFailure,services-marketing:modules/marketing/tests/integration/services/audience-evaluation.integration.spec.ts#leaves the audience’s version alone, so an editor’s next save is not stale,services-marketing:modules/marketing/tests/integration/services/audience-evaluation.integration.spec.ts#runs every read as the signed-in user, not as the audience’s owner,services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#refuses a person who may not query contacts with a 403, never an empty audience
14Resource authority starts a count but cannot lend query authorityinteractionapinegativeproposed
The owner can query contacts and Ben has audience-view authority without contact-query authority.
Steps
[
{
"do": "Ben starts a count; run its job and inspect the evaluation.",
"provenance": "proposed",
"source": [
"services-marketing:modules/marketing/tests/integration/services/count-everyone-job.integration.spec.ts#settles the evaluation failed with Platform’s code, never counted and never empty",
"services-marketing:modules/marketing/tests/unit/count-everyone-job.spec.ts#is submitted under the key that lets a person count: audiences.view",
"services-marketing:modules/marketing/tests/integration/services/count-everyone-job.integration.spec.ts#does not run as the audience’s owner, who may query the dataset, in its place",
"services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#answers a count by a person who may not query the dataset 202, then reads it back failed with Platform’s code, never counted"
]
}
]
Expected
The request is accepted and its evaluation later fails with the dataset-access reason without substituting the owner.
Data
Create the named records in a run-owned workspace; use a controllable query dependency and retain versions between steps.
Source
services-marketing:modules/marketing/tests/integration/services/count-everyone-job.integration.spec.ts#settles the evaluation failed with Platform’s code, never counted and never empty,services-marketing:modules/marketing/tests/unit/count-everyone-job.spec.ts#is submitted under the key that lets a person count: audiences.view,services-marketing:modules/marketing/tests/integration/services/count-everyone-job.integration.spec.ts#does not run as the audience’s owner, who may query the dataset, in its place,services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#answers a count by a person who may not query the dataset 202, then reads it back failed with Platform’s code, never counted
15Taking ownership does not change another requester’s visibilityinteractionapiproposed
Maya can query all contacts; Ben can query only east contacts.
Steps
[
{
"do": "Transfer the audience to Maya, then preview and count as Ben.",
"provenance": "proposed",
"source": [
"services-marketing:modules/marketing/tests/integration/services/audience-evaluation.integration.spec.ts#runs every read as the signed-in user, not as the audience’s owner",
"services-marketing:modules/marketing/tests/integration/services/count-everyone-job.integration.spec.ts#does not run as the audience’s owner, who may query the dataset, in its place",
"services-marketing:modules/marketing/tests/integration/services/audiences.integration.spec.ts#makes the administrator the owner"
]
}
]
Expected
Both calculations retain Ben’s identity and contain only the contacts he can read.
Data
Create the named records in a run-owned workspace; use a controllable query dependency and retain versions between steps.
Source
services-marketing:modules/marketing/tests/integration/services/audience-evaluation.integration.spec.ts#runs every read as the signed-in user, not as the audience’s owner,services-marketing:modules/marketing/tests/integration/services/count-everyone-job.integration.spec.ts#does not run as the audience’s owner, who may query the dataset, in its place,services-marketing:modules/marketing/tests/integration/services/audiences.integration.spec.ts#makes the administrator the owner
16Audience permission and query permission are independent gatesinteractionapinegativeproposed
Maya can query contacts but has no Marketing resource key; Ben has audience-view authority but cannot query contacts.
Steps
[
{
"do": "Request a preview as each person.",
"provenance": "proposed",
"source": [
"services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#refuses a person who may not query contacts with a 403, never an empty audience",
"services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#refuses a user holding no Marketing key the preview, the count and the read of an evaluation"
]
}
]
Expected
Maya is refused at the Marketing boundary; Ben reaches evaluation but receives the source-query refusal.
Data
Create the named records in a run-owned workspace; use a controllable query dependency and retain versions between steps.
Source
services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#refuses a person who may not query contacts with a 403, never an empty audience,services-marketing:modules/marketing/tests/e2e/audience-evaluation.e2e.spec.ts#refuses a user holding no Marketing key the preview, the count and the read of an evaluation
17A submitted job keeps a requester and no fallback ownerinvariantunittest
A viewer starts a count over an audience owned by someone else.
Steps
[
{
"do": "Inspect the submitted root and the input given to its task.",
"provenance": "test",
"source": [
"services-marketing:modules/marketing/tests/unit/count-everyone-job.spec.ts#hands the engine the person who asked, as the person the count runs as",
"services-marketing:modules/marketing/tests/unit/count-everyone-job.spec.ts#hands the engine no owner of the audience to fall back to",
"TST-MKT-MKT-020"
]
}
]
Expected
The task receives the viewer; its input has no owner to substitute.
Data
Use the suite’s isolated fixtures and dependency doubles within its recorded verification boundary.