Review a person’s record-view history

Purpose

Provide an authorized chronological account of the records a person has opened.

How It Works

A signed-in person requests their own workspace view history under its reading permission. An administrator uses a separate authority to request a named person’s history. The response contains visits, without resolving current record names or checking whether the record still exists. Paging continues through a stable timestamp-and-identity order. A supported record-type filter narrows the result. Invalid sizes and unsupported types produce explicit refusals. This read differs from Recent Items, which resolves records through the query layer. The accepted history capability currently has no dedicated console screen.

Relationships

Record owners establish the activity, and authorized queries use visits to support recent work without replacing raw history.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: A person can inspect their raw visit history under appropriate authority.Administrative review remains distinct from individual history readership.
Surfaces: api
Preconditions: The caller holds own-history authority or the separate permission needed for a colleague’s views.
Postconditions: History inspection leaves activity records unchanged.
Intent sources: services-platform:docs/audit-events.md#2026-10-12 — Final acceptance (scope: the person's raw view history and an administrator's read of it)

Controls

25 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-CRY-001 TC-CRY-002 TC-CRY-003 TC-CRY-004 TC-DAT-004 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-PI-001 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`platform.record-views.read`	api	tenant
`platform.audit-events.read`	api	tenant

Business Rules

8 rules, 6 to be proved before approval. A rule's product intent is derived from its origin: 8 confirmed by a product decision, the rest inheriting this capability's confirmed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Confirmed	Own-history reads require view-history authority, while a colleague’s history requires the separate administrator-tier audit permission. origin: services-platform:docs/audit-events.md#Permissions proved by `ATS-PFM-OPS-009-01`, `TST-PFM-OPS-064`	permission	api	test services-platform:modules/audit/tests/unit/aws/api/audit-permissions.spec.ts#declares reading another user’s audit events at the admin tier, which is what keeps it out of Read Only
`02`must prove Confirmed	Raw history retains one entry per visit in descending timestamp and identity order, including visits to deleted records without resolving their current contents. proved by `ATS-PFM-OPS-008-12`, `ATS-PFM-OPS-009-02`, `ATS-PFM-OPS-009-07`, `ATS-PFM-OPS-010-11`, `TST-PFM-OPS-061`	policy	service	test services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#still holds the view after the contact is gone, because a trail is not a list of records
`03`must prove Confirmed	History defaults to twenty-five rows and rejects requested sizes outside one through fifty. proved by `ATS-PFM-OPS-009-03`, `TST-PFM-OPS-061`	validation	api, service	test services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a page larger than the maximum, naming it
`04`must prove Confirmed	History pagination uses timestamp and event identity to traverse tied timestamps without gaps or repeats and rejects malformed cursor representations. proved by `ATS-PFM-OPS-009-04`, `TST-PFM-OPS-059`	validation	api, service, database	test services-platform:modules/audit/tests/integration/services/persistence/audit-events.queries.integration.spec.js#steps over the tie correctly when a page boundary falls inside it
`05`must prove Confirmed	Filtering history by an unsupported registered record type is refused rather than returning an empty page. proved by `ATS-PFM-OPS-009-05`, `TST-PFM-OPS-061`	validation	service	test services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a record type the registry does not hold, rather than answering an empty page
`06`must prove Confirmed	History queries restrict results to the requested actor in the current workspace. proved by `ATS-PFM-OPS-009-06`, `TST-PFM-OPS-061`	permission	service, database	test services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#answers nothing of another tenant’s history
`07` Confirmed	View-history reads exclude merge, intervention and other event types stored in the same trail.	policy	service	documented services-platform:docs/audit-events.md#The merge event
`08` Confirmed	The accepted history scope provides API reads for a person and an administrator without a console history screen. origin: services-platform:docs/audit-events.md#2026-10-12 — Final acceptance	policy	console	documented services-platform:docs/audit-events.md#2026-10-12 — Final acceptance (scope excludes a history UI)

Scenarios

Id	Given	When	Then	Provenance
`01`	A person has view history containing a visit to a removed record.	The person pages through the authorized history.	The raw visit remains present and pagination does not repeat or omit entries.	inferred services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#pages the whole history in sevens with no gap and no repeat
`02`	A reader lacks the colleague-history permission.	The reader requests someone else’s views.	The separate administrative route refuses the read.	inferred services-platform:modules/audit/tests/unit/aws/api/audit-permissions.spec.ts#declares reading another user’s audit events at the admin tier, which is what keeps it out of Read Only

Planning

Implementation

Review a person’s record-view history ​

Purpose ​

How It Works ​

Relationships ​