Rhythm 2.0 Specifications

Appearance

CAP-PFM-LLM-016Inspect captured AI content with a live access grant

Markdown

CAP-PFM-LLM-016

Inspect captured AI content with a live access grant

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationPartially observed

Planning

Feature
FEAT-PFM-LLM-05
Exercised by
FAS-PFM-LLM-05-01, FAS-PFM-LLM-05-04
Key concepts
CON-PFM-LLM-001
Actors
ACT-PFM-004
Depends on
CAP-PFM-LLM-004
Related
CAP-PFM-LLM-011
Proved by
ATS-PFM-LLM-016

Implementation

Executable suites
TST-PFM-LLM-024, TST-PFM-LLM-054, TST-PFM-LLM-073

KindCapabilityProduct areaPlatformModuleAI Requests, Usage and the Jazz AI TeammateRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

Inspect captured AI content with a live access grant ​

Purpose ​

Constrain sensitive diagnostic reads to accountable staff access.

How It Works ​

A staff member needs both the sensitive content-reading key and an eligible live access grant. Platform resolves the organization and checks the grant before looking up the request. Missing eligible access produces an audited refusal. With access, the service returns the redacted body or its unavailable capture status. It records successful body and status returns before returning them to the caller. Missing records and store failures follow narrower audit paths than successful reads. Ordinary usage readers cannot open content through their read key. The console currently displays capture status and keeps administrator read controls disabled.

Relationships ​

  • Retain redacted AI evidence and remove it safely supplies the prerequisite behavior for this outcome.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Captured bodies require evidence permission and a live workspace access grant.Successful reads and missing-grant refusals receive audit records.Unavailable captured content has an explicit status.
Surfaces
apiconsole
Preconditions
The reader holds an active approved or emergency workspace access grant.
Postconditions
Successful content reads and missing-grant refusals receive audit entries.
Constraints
The content viewer is incomplete and lacks an HTTP end-to-end test.
Intent sources
services-platform:docs/proposals/llm-observability/11-decisions.md#D-1

Controls

22 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-DAT-001 TC-DAT-003 TC-DAT-004 TC-IAM-003 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-PI-001 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.llm-usage.read-evidenceapirecord
hq.llm-usage.read-evidenceconsoleglobal

Business Rules

7 rules, 6 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
Content reads require the sensitive HQ content key plus an active approved or emergency organization access grant inside its window; standing grants do not qualify.
proved by ATS-PFM-LLM-011-13, ATS-PFM-LLM-016-01, ATS-PFM-LLM-016-06, TST-PFM-LLM-024, TST-PFM-LLM-073
permissionapi, serviceobserved
services-platform:modules/llm/services/evidence/evidence-access.ts
02must prove
Proposed
A read after the access window expires is refused and records the missing eligible access.
proved by ATS-PFM-LLM-016-01, TST-PFM-LLM-024
permissionservicetest
services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#refuses the holder once the grant’s window has closed, and records the refusal
03must prove
Proposed
The content service audits missing-grant refusals and successful body or status answers before returning content, but route rejections, missing records and storage failures do not get that entry.
proved by ATS-PFM-LLM-016-02, TST-PFM-LLM-024
invariantserviceobserved
services-platform:modules/llm/services/evidence/evidence-access.ts:readInvocationEvidence
04must prove
Proposed
The read returns redacted request or response content or a skipped, failed or purged status, including purged when the object has disappeared, without its storage location.
proved by ATS-PFM-LLM-004-06, ATS-PFM-LLM-016-03, TST-PFM-LLM-024
policyserviceobserved
services-platform:modules/llm/services/evidence/evidence-access.ts
05must prove
Proposed
With an eligible grant, missing or foreign requests return not found without auditing; nonexistent organizations return not found before checking access grants.
proved by ATS-PFM-LLM-016-04, TST-PFM-LLM-024
validationserviceobserved
services-platform:modules/llm/services/evidence/evidence-access.ts
06must prove
Proposed
HQ reader policies exclude the sensitive content key, and the console grants it only to the administrator among HQ roles.
proved by ATS-PFM-LLM-016-05, TST-PFM-LLM-054
permissionconsoleobserved
react-console:lib/hq/staff-roles.ts
07
Proposed
Support readers see capture status without read buttons, while administrators see disabled read buttons.
permissionconsoletest
react-console:e2e/mock/hq-ai-usage.mock.spec.ts#a Support Representative sees evidence statuses but no read buttons

Scenarios

IdGivenWhenThenProvenance
01A reader has a valid evidence access grant.The reader fetches captured bodies twice.Each successful read produces its own audit entry linked to the grant.test
services-platform:modules/llm/tests/integration/services/evidence/evidence-access.integration.spec.js#writes a second row for a second read of the same body, so two reads are two rows

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software