The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.
| # | Surface | Action | Capability | Expected | Provenance |
|---|---|---|---|---|---|
| 1 | /hq/tenants/{tenantId} | Inspect the workspace licensing section in HQ. | CAP-PFM-OPS-013 | Readable states and authors explain its applications and decision history. | test react-console:e2e/dev/hq-licensing.dev.spec.ts#the panel lists the Fictional Association's applications, names every author and folds the past overrides away |
| 2 | createTenantLicenceOverride | Record an explained Withhold Override. | CAP-PFM-OPS-011 | The staff view reflects the saved withhold and its reason. | test react-console:e2e/dev/hq-licensing.dev.spec.ts#the licensing panel withholds an application on the development tenant with a reason, and revokes it |
| 3 | job | Request invalidation after the commercial write. | CAP-PFM-OPS-014 | The committed decision has a submitted flush request whose completion remains asynchronous. | observed services-platform:modules/licensing/services/enablement/grant-licence-override.ts:grantLicenceOverride |
| 4 | /console/{tenantId}/configuration | Inspect Applications as the customer administrator. | CAP-PFM-OPS-016 | The customer view presents the application as not licensed without the internal withhold explanation. | test react-console:e2e/dev/hq-licensing.dev.spec.ts#the tenant's own administrator reads Configuration › Applications with the same words |
| 5 | /console/{tenantId} | Follow an existing application link from the customer workspace. | CAP-PFM-SEC-007 | When the refreshed context reflects the refusal, the unavailable application is omitted from navigation and its entry is refused. | test react-console:e2e/mock/application-access.mock.spec.ts#a deep link into one of them says the application isn't available |
| 6 | revokeTenantLicenceOverride | Withdraw the withhold decision. | CAP-PFM-OPS-011 | History retains its revocation and otherwise eligible coverage can govern again. | test react-console:e2e/dev/hq-licensing.dev.spec.ts#the licensing panel withholds an application on the development tenant with a reason, and revokes it |
| Path | From step | Condition | Path taken | Outcome | Provenance |
|---|---|---|---|---|---|
| alternate | 2 | A first grant addresses an application with no operational record. | Attempt its preparation after saving the decision. | Preparation records enabled or an explained failure without discarding the grant. | test services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#ends as provisioning_failed rather than throwing, so the decision that caused it survives |
| failure | 2 | A customer-workspace grant omits expiry. | Block the dialog and reject the invalid grant at the service. | No commercial decision is saved. | test services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a grant on a customer tenant that does not say when it ends, with 400 |
| failure | 1 | Staff have readership without management authority. | Omit panel actions and refuse write requests. | The existing decision state remains intact. | test services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a staff member holding only hq.licensing.read on a write, with 403 |
| Id | Statement | Provenance |
|---|---|---|
01 | Customer application responses hide internal withhold reasons and staff attribution. | test services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it |
02 | Completed withhold and revocation flows attempt the correctly directed security-history entries. | test services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#records the revocation of a withhold as a widening, because it gives the application back |
03 | Completed staff licence changes request invalidation, with cache expiry remaining fallback if asynchronous flush execution fails. | observed services-platform:modules/licensing/services/enablement/grant-licence-override.ts:withdrawLicenceOverride |
End-to-end policy: required: Staff and customer surfaces explain related states differently, so browser coverage must accompany the authorization and decision evidence.