| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-01 The dataset catalog includes all registered workspace datasets, marks each person’s access, and counts usable datasets per application rather than hiding unauthorized entries. | yes | ATS-PFM-QRY-001-01, ATS-PFM-QRY-001-14 | TST-PFM-QRY-225 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-02 Dataset descriptions and runs require query-surface access and the dataset’s query permission; missing access is refused with the permission named, while an unregistered dataset is not found. | yes | ATS-PFM-QRY-001-02, ATS-PFM-QRY-001-13, ATS-PFM-QRY-005-17 | TST-PFM-QRY-225 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-03 When the dataset also declares a record-read permission, readers need both permissions, and a denied read permission makes its query surfaces unavailable despite a query grant. | yes | ATS-PFM-QRY-001-03 | TST-PFM-QRY-254 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-04 A dataset query also requires access to its owning application, and a missing application grant produces a refusal naming that permission. | yes | ATS-PFM-QRY-001-04 | TST-PFM-QRY-224 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-05 A description combines registered fields, workspace custom information and labels with permitted relationships, while excluding physical storage details. | yes | ATS-PFM-QRY-001-05 | TST-PFM-QRY-225 (not-run), TST-PFM-QRY-296 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-06 The product should expose each registered record column for querying unless its owner records an exclusion reason. | no | | |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-07 A changed field, label, classification or registration invalidates the relevant cached description so the next request reflects it. | yes | ATS-PFM-QRY-001-06 | TST-PFM-QRY-263 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-08 Descriptions advertise initial columns, ordering, criteria and discovery statuses, but execution does not add those suggested criteria to a submitted query. | yes | ATS-PFM-QRY-001-07, ATS-PFM-QRY-001-12, ATS-PFM-QRY-002-17 | TST-PFM-QRY-262 (not-run), TST-PFM-QRY-276 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-09 Active custom objects become workspace datasets without deployment and require the custom-record query permission scoped to the particular object. | yes | ATS-PFM-QRY-001-08 | TST-PFM-QRY-222 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-10 Application deployments register datasets through an internal invocation, whose response identifies rejected declarations so deployment can report them. | yes | ATS-PFM-QRY-001-09 | TST-PFM-QRY-225 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-11 Registration rejects workspace datasets without a workspace-bearing source and references that cross between workspace and system dataset scopes. | yes | ATS-PFM-QRY-001-10 | TST-PFM-QRY-332 (not-run) |
| CAP-PFM-QRY-001 | BR-CAP-PFM-QRY-001-12 Registered record-opening fields must belong directly to the record; unknown fields and selected collection values are rejected. | yes | ATS-PFM-QRY-001-11 | TST-PFM-QRY-332 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-01 Query execution confines source records and joins to the requested workspace, with database row security also preventing cross-workspace reads when a compiled predicate is absent. | yes | ATS-PFM-QRY-001-12, ATS-PFM-QRY-002-01, ATS-PFM-QRY-002-17, ATS-PFM-QRY-002-19, ATS-PFM-QRY-003-12, ATS-PFM-QRY-004-08, ATS-PFM-QRY-014-11 | TST-PFM-QRY-296 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-02 Queries use a read-only reader transaction with a time limit; timeouts produce an actionable limit message, and other failures reveal neither statement text nor stored data. | yes | ATS-PFM-QRY-002-02 | TST-PFM-QRY-289 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-03 Unsupported fields, operators and relationships are rejected without distinguishing inaccessible metadata from metadata that does not exist. | yes | ATS-PFM-QRY-002-03 | TST-PFM-QRY-296 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-04 Criterion validation rejects blank text, empty identity lists, fractional integer values, unsafe whole numbers and dates outside the required calendar-date form. | yes | ATS-PFM-QRY-002-04 | TST-PFM-QRY-296 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-05 Paging cursors carry the query’s ordered position, and malformed cursors, cursors from another query or cursors with incompatible keys are rejected. | yes | ATS-PFM-QRY-002-05 | TST-PFM-QRY-296 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-06 Requested totals count all matching base records or groups in the page’s database snapshot, independently of cursor position and join multiplication; unrequested totals are omitted. | yes | ATS-PFM-QRY-002-06 | TST-PFM-QRY-287 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-07 Recently Viewed returns this person’s workspace records once each at their latest viewing time, newest first, and rejects system executions without a person. | yes | ATS-PFM-QRY-002-07 | TST-PFM-QRY-290 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-08 The current-person criterion resolves from the execution identity on a user-bearing field with a compatible operator, and rejects unsuitable fields, operators and non-person executions. | yes | ATS-PFM-QRY-002-08 | TST-PFM-QRY-270 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-09 Unsaved execution rejects requested-at-run values and supplied parameter maps, while validation reports those uses as located problems in a successful validation response. | yes | ATS-PFM-QRY-002-09 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-10 Calendar and relative-date criteria use the workspace’s time zone and calendar, and date previews report the calendar used. | yes | ATS-PFM-QRY-002-10, ATS-PFM-QRY-020-07 | TST-PFM-QRY-226 (not-run), TST-PFM-QRY-296 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-11 Validation collects located query problems without executing the query, while execution stops at its first invalid part. | yes | ATS-PFM-QRY-002-11, ATS-PFM-QRY-002-18 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-12 Linked result cells identify records whose identities the reader may select, and an override referring to a record absent from the result is rejected. | yes | ATS-PFM-QRY-002-12 | TST-PFM-QRY-225 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-13 Reference columns display the referenced record’s name, fall back to its identity when nameless, and remain empty when absent; an explicitly selected identity stays separate. | yes | ATS-PFM-QRY-002-13 | TST-PFM-QRY-293 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-14 A field reached through a record reference supports one many-to-one traversal and rejects a second traversal. | yes | ATS-PFM-QRY-002-14 | TST-PFM-QRY-296 (not-run) |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-15 The documented query bounds are 255 selected fields, five sort keys, 100 criteria at depth six, two to-one hops and pages of at most one thousand rows, defaulting to one hundred. | yes | ATS-PFM-QRY-002-15 | |
| CAP-PFM-QRY-002 | BR-CAP-PFM-QRY-002-16 Grouped calculations apply sums, averages, minima and maxima to the matching group rows, preserve appropriate result types, and yield no value for a field absent from every row. | yes | ATS-PFM-QRY-002-16 | TST-PFM-QRY-286 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-01 Query generation requires its own permission, independently of query-reading access, and a caller lacking that permission is refused. | yes | ATS-PFM-QRY-003-01 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-02 Generation requires access to the requested dataset, rejecting unauthorized datasets and reporting unregistered datasets as missing. | yes | ATS-PFM-QRY-003-02 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-03 Generation accepts bounded, nonempty written text and returns the same validation code for empty, oversized or non-text requests. | yes | ATS-PFM-QRY-003-03 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-04 A generation request returns a record to poll, which only its initiating person can read within the originating workspace. | yes | ATS-PFM-QRY-003-04 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-05 A generated query runs through ordinary execution as the requester and therefore cannot expand that person’s access. | yes | ATS-PFM-QRY-003-05, ATS-PFM-QRY-003-12 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-06 An exhausted organizational AI allowance refuses the request immediately with the required and remaining amounts. | yes | ATS-PFM-QRY-003-06 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-07 Each request records one metered organizational invocation while withholding model and cost details from its requester. | yes | ATS-PFM-QRY-003-07 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-08 Generation may return clarification and interpretations without providing a query. | no | | |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-09 Refinement creates a separate generation linked to its predecessor and rejects a predecessor still in progress. | yes | ATS-PFM-QRY-003-08 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-10 An organization at its simultaneous-call limit receives a retry-later generation failure, with the refused invocation’s reason recorded. | yes | ATS-PFM-QRY-003-09 | TST-PFM-QRY-227 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-11 The recovery sweep fails work still unsettled after the worker timeout and margin, preserves an existing verdict, and deletes request and outcome records older than thirty days. | yes | ATS-PFM-QRY-003-10 | TST-PFM-QRY-307 (not-run) |
| CAP-PFM-QRY-003 | BR-CAP-PFM-QRY-003-12 Generation rejects invalid or inaccessible query context before creating work; failure to invoke the worker settles the admitted generation as failed instead of leaving it working. | yes | ATS-PFM-QRY-003-11 | TST-PFM-QRY-307 (not-run) |
| CAP-PFM-QRY-004 | BR-CAP-PFM-QRY-004-01 Rhythm HQ queries require both the system-query permission and the chosen system dataset’s permission; the surface permission alone leaves every dataset unauthorized. | yes | ATS-PFM-QRY-004-01 | TST-PFM-QRY-235 (not-run) |
| CAP-PFM-QRY-004 | BR-CAP-PFM-QRY-004-02 The system catalog exposes only HQ datasets and treats workspace datasets requested there as missing. | yes | ATS-PFM-QRY-004-02, ATS-PFM-QRY-004-09 | TST-PFM-QRY-235 (not-run) |
| CAP-PFM-QRY-004 | BR-CAP-PFM-QRY-004-03 System datasets and their single-hop references read across customers without a workspace restriction. | yes | ATS-PFM-QRY-004-03 | TST-PFM-QRY-235 (not-run) |
| CAP-PFM-QRY-004 | BR-CAP-PFM-QRY-004-04 A system query cannot join a workspace dataset into its system model. | yes | ATS-PFM-QRY-004-04, ATS-PFM-QRY-004-08 | TST-PFM-QRY-235 (not-run) |
| CAP-PFM-QRY-004 | BR-CAP-PFM-QRY-004-05 System datasets offer the all-records scope without workspace custom fields or label overrides and reject Recently Viewed. | yes | ATS-PFM-QRY-004-05 | TST-PFM-QRY-235 (not-run) |
| CAP-PFM-QRY-004 | BR-CAP-PFM-QRY-004-06 System and workspace recipe libraries remain separate, and either surface reports the other’s recipes as missing. | yes | ATS-PFM-QRY-004-06 | TST-PFM-QRY-228 (not-run), TST-PFM-QRY-235 (not-run) |
| CAP-PFM-QRY-004 | BR-CAP-PFM-QRY-004-07 A workspace’s AI request records cannot be queried through the HQ system surface. | yes | ATS-PFM-QRY-004-07 | TST-PFM-QRY-228 (not-run) |
| CAP-PFM-QRY-004 | BR-CAP-PFM-QRY-004-08 HQ permissions are reserved for Rhythm staff and cannot be granted to customer users at any scope. | no | | |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-01 Staff permissions separately govern custom-table reading, drafting and preview, publication and lifecycle changes, and assignment; customer users cannot reach these routes and authoring does not grant publication. | yes | ATS-PFM-QRY-005-01 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-02 A custom-table identity cannot be reused for a second definition. | yes | ATS-PFM-QRY-005-02 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-03 Draft analysis checks permitted read behaviour, identifies source access requirements and proposes output fields, returning rejected statements as analysis problems. | yes | ATS-PFM-QRY-005-03 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-04 Custom definitions accept only supported platform placeholders and reject user-declared parameters or unknown placeholders. | yes | ATS-PFM-QRY-005-04 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-05 Analysis, draft validation, publication and preview use the configured validation workspace; absent configuration leaves reads available but returns unavailable for those operations, and another workspace cannot be previewed. | yes | ATS-PFM-QRY-004-09, ATS-PFM-QRY-005-05 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-06 A breaking publication waits for acknowledgment of every affected saved query and otherwise returns the changes and dependent query identities. | yes | ATS-PFM-QRY-005-06, ATS-PFM-QRY-005-18 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-07 Assigned active publications appear in the dataset catalog; deprecated publications still resolve and disabled publications produce an explicit execution refusal. | yes | ATS-PFM-QRY-005-07 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-08 A custom dataset requires every permission its statement reads, marks readers without them unauthorized, and refuses execution with the missing permission identified. | yes | ATS-PFM-QRY-005-08 | |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-09 Pins reference published versions, with the most specific covering pin taking precedence; unpinned grants preserve broader pins, and clearing a pin follows another covering pin or the latest publication. | yes | ATS-PFM-QRY-005-09 | TST-PFM-QRY-223 (not-run), TST-PFM-QRY-372 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-10 Deprecation removes a custom dataset from selection lists while preserving execution, whereas disabling it refuses execution with a reason. | yes | ATS-PFM-QRY-001-13, ATS-PFM-QRY-005-10, ATS-PFM-QRY-005-17 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-11 A published statement whose stored fingerprint no longer matches is refused without exposing statement text. | yes | ATS-PFM-QRY-005-11 | |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-12 Custom-table history attributes lifecycle actions to their actors without retaining statement text or record values. | yes | ATS-PFM-QRY-005-12 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-13 An assigned custom table’s reference exposes a reverse one-to-many relationship from its referenced dataset only in workspaces covered by the assignment. | yes | ATS-PFM-QRY-005-13 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-14 Changes to definitions, drafts and assignments must use their read versions, and stale versions are rejected. | yes | ATS-PFM-QRY-005-14 | TST-PFM-QRY-223 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-15 Revalidation revisits active or deprecated publications and pinned versions, records meaningful health changes without statement text or data, limits repeated passing history to once daily, and skips without a validation workspace. | yes | ATS-PFM-QRY-005-15 | TST-PFM-QRY-250 (not-run) |
| CAP-PFM-QRY-005 | BR-CAP-PFM-QRY-005-16 Analysis rejects statements that write or lock records, contain recursion, use forbidden schemas or functions, or fail the single permitted-read requirement. | yes | ATS-PFM-QRY-005-16 | TST-PFM-QRY-371 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-01 A private saved query is visible only to its owner among customer users; colleagues and customer managers receive not-found responses. | yes | ATS-PFM-QRY-006-01 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-02 Role-shared queries are visible to their owners, managers and current active holders of a selected role; other users neither list nor open them. | yes | ATS-PFM-QRY-006-02, ATS-PFM-QRY-006-17, ATS-PFM-QRY-007-12 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-03 The library’s read permission allows listing, opening and running shared queries, while use is required for creation, replacement and deletion, so Read Only staff cannot write. | yes | ATS-PFM-QRY-006-03 | TST-PFM-QRY-231 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-04 Changing between private and organization visibility requires share permission, which is included by default for users allowed to save queries. | yes | ATS-PFM-QRY-006-04 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-05 The owner can maintain a query, and managers can maintain shared queries, while customer managers cannot reach private queries. | yes | ATS-PFM-QRY-006-05 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-06 Rhythm staff using a workspace staff grant can read and maintain every saved query, including customer-private queries. | yes | ATS-PFM-QRY-006-06 | TST-PFM-QRY-413 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-07 Role sharing accepts one to one hundred distinct active workspace roles, replaces the complete selected set, and excludes archived roles from membership matches. | yes | ATS-PFM-QRY-006-07 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-08 Query audience narrowing is refused when a dependent report or dashboard would have a wider audience, with the blocking reports and owners identified. | yes | ATS-PFM-QRY-006-08, ATS-PFM-QRY-006-18, ATS-PFM-QRY-011-14 | TST-PFM-QRY-231 (not-run), TST-PFM-QRY-345 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-09 A save preserves omitted visibility and preserves existing role selections when role visibility is supplied without a replacement set. | yes | ATS-PFM-QRY-006-09 | TST-PFM-QRY-231 (not-run), TST-PFM-QRY-345 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-10 Saving validates the definition for the saver without running it, refusing unauthorized or missing datasets and collecting the remaining definition problems. | yes | ATS-PFM-QRY-002-18, ATS-PFM-QRY-005-18, ATS-PFM-QRY-006-10, ATS-PFM-QRY-008-11 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-11 The saved definition retains its exact values, fits within 64 KiB, and identifies the same dataset as its query record. | yes | ATS-PFM-QRY-006-11 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-12 Saved-query names are unique for each owner within a workspace after case and surrounding-space normalization, while other owners or workspaces can reuse them. | yes | ATS-PFM-QRY-006-12 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-13 Replacement requires the version previously read, rejects a missing version and reports a conflict when it is stale. | yes | ATS-PFM-QRY-006-13 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-14 A saved query used by a report, dashboard or schedule cannot be deleted, and the refusal identifies its dependencies. | yes | ATS-PFM-QRY-006-14, ATS-PFM-QRY-006-19, ATS-PFM-QRY-015-17 | TST-PFM-QRY-233 (not-run), TST-PFM-QRY-349 (not-run) |
| CAP-PFM-QRY-006 | BR-CAP-PFM-QRY-006-15 Library pages, counts and facets exclude colleagues’ private queries, while opening a query reports its current reader-specific problems rather than rejecting the entire read. | yes | ATS-PFM-QRY-006-15 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-01 Shared queries execute with the runner’s own dataset permissions and never confer additional field, row or dataset access. | yes | ATS-PFM-QRY-006-17, ATS-PFM-QRY-007-01, ATS-PFM-QRY-007-12, ATS-PFM-QRY-007-13 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-02 Runs accept paging changes, requested values and a refinement; paging options merge into stored paging, and other request content is rejected. | yes | ATS-PFM-QRY-007-02 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-03 Requested-at-run declarations must match their criterion types and options, and saving rejects undeclared, unused, mismatched or unsupported requests for values. | yes | ATS-PFM-QRY-007-03 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-04 Execution supplies given values or defaults, preserves text exactly, and rejects missing required values, wrong types, out-of-bound values, disallowed options and unrequested names at their locations. | yes | ATS-PFM-QRY-007-04 | TST-PFM-QRY-234 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-05 Refinement adds criteria to the stored criteria, may replace columns, grouping and ordering, and retains the stored scope, joins, links and requested values without widening the matching population. | yes | ATS-PFM-QRY-007-05 | TST-PFM-QRY-233 (not-run), TST-PFM-QRY-343 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-06 A reader’s refinement can select permitted dataset columns omitted by the author. | yes | ATS-PFM-QRY-007-06 | TST-PFM-QRY-343 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-07 A refinement cannot introduce requested-at-run values or substitute for a required supplied value. | yes | ATS-PFM-QRY-007-07 | TST-PFM-QRY-343 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-08 Applications can enumerate a saved query’s record identities in ordered pages of one thousand, resume with a criteria-bound cursor and definition fingerprint, and request a count that reports when its supplied cap is reached. | yes | ATS-PFM-QRY-007-08 | TST-PFM-QRY-347 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-09 Each population page rebuilds the named person’s access and rejects missing, suspended, portal or wrong-customer users and missing permissions; inaccessible saved queries are reported as missing. | yes | ATS-PFM-QRY-007-09 | TST-PFM-QRY-341 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-10 Recently Viewed queries, unanswered required values and joins that repeat base records are rejected as application populations. | yes | ATS-PFM-QRY-007-10 | TST-PFM-QRY-341 (not-run), TST-PFM-QRY-347 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-11 Population logs identify the query, dataset and criteria structure without including values or record identities. | yes | ATS-PFM-QRY-007-11 | TST-PFM-QRY-347 (not-run) |
| CAP-PFM-QRY-007 | BR-CAP-PFM-QRY-007-12 Population entry points restrict invocation to their designated application service roles, with separate Accounting and Marketing entry points. | no | | |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-01 The recipe catalog orders active recipes by category and name, includes parameters and authorization flags, excludes retired recipes, and allows catalog reads without dataset permissions. | yes | ATS-PFM-QRY-008-01 | TST-PFM-QRY-229 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-02 Creating or running a recipe draft requires access to its base dataset and every joined dataset. | yes | ATS-PFM-QRY-001-14, ATS-PFM-QRY-008-02 | TST-PFM-QRY-229 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-03 Recipe drafting checks existence and retirement before dataset access, then reports all unsatisfied values with labels before checking the completed query. | yes | ATS-PFM-QRY-008-03 | TST-PFM-QRY-229 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-04 A recipe draft becomes an independent concrete query whose saved origin records the recipe version, and later recipe releases do not change it. | yes | ATS-PFM-QRY-008-04, ATS-PFM-QRY-008-11 | TST-PFM-QRY-229 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-05 Saved recipe provenance must name a recipe registered at least once, while a subsequently retired recipe remains a valid origin. | yes | ATS-PFM-QRY-008-05 | TST-PFM-QRY-229 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-06 Recipe execution immediately runs the drafted query as the person, using the same narrowing refinement rules as saved queries. | yes | ATS-PFM-QRY-008-06 | TST-PFM-QRY-229 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-07 Recipe registration validates the whole release before writing, requires live datasets owned by that application, and rejects fields specific to a workspace’s custom or configured metadata. | yes | ATS-PFM-QRY-008-07 | TST-PFM-QRY-326 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-08 A recipe content change requires a changed version. | yes | ATS-PFM-QRY-008-08 | TST-PFM-QRY-326 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-09 Registration retires recipes omitted from a release, restores reintroduced recipes and avoids writes for unchanged declarations. | yes | ATS-PFM-QRY-008-09, ATS-PFM-QRY-008-12, ATS-PFM-QRY-009-12 | TST-PFM-QRY-326 (not-run) |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-10 Custom-object activation creates recipes whose availability follows that object independently in each workspace. | no | | |
| CAP-PFM-QRY-008 | BR-CAP-PFM-QRY-008-11 A recipe’s current-person value is valid only on a user-bearing field and is rejected elsewhere during registration. | yes | ATS-PFM-QRY-008-10 | TST-PFM-QRY-270 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-01 A saved view requires a live recipe and its dataset, rejecting missing or retired recipes and a dataset that differs from its anchor. | yes | ATS-PFM-QRY-009-01 | TST-PFM-QRY-210 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-02 Explorer rejects a recipe join that repeats base records and identifies the incompatible join. | yes | ATS-PFM-QRY-009-02 | TST-PFM-QRY-211 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-03 Every view save validates its definition against the reader’s resolved recipe model and locates unsupported fields. | yes | ATS-PFM-QRY-009-03 | TST-PFM-QRY-210 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-04 Reading a view returns model problems for repair rather than rejecting the definition, and an absent recipe produces a recipe-missing problem. | yes | ATS-PFM-QRY-008-12, ATS-PFM-QRY-009-04, ATS-PFM-QRY-009-12 | TST-PFM-QRY-211 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-05 Private views remain owner-only and appear missing to others, while workspace-shared views are readable to users with dataset access. | yes | ATS-PFM-QRY-009-05 | TST-PFM-QRY-210 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-06 View sharing requires share permission, maintaining another owner’s shared view requires manage permission, and ownership and dataset cannot change. | yes | ATS-PFM-QRY-009-06 | TST-PFM-QRY-210 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-07 Explorer operations require access to the base and joined datasets of the anchored recipe. | yes | ATS-PFM-QRY-009-07, ATS-PFM-QRY-009-13, ATS-PFM-QRY-010-13 | TST-PFM-QRY-210 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-08 Views accept names of one to 120 characters, one to fifty columns, one to five sort keys and page sizes of ten, twenty-five, fifty or one hundred, store no current position, and are capped at two hundred per dataset and workspace. | yes | ATS-PFM-QRY-009-08 | TST-PFM-QRY-218 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-09 Team-based view sharing remains reserved and is rejected. | yes | ATS-PFM-QRY-009-09 | TST-PFM-QRY-210 (not-run), TST-PFM-QRY-218 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-10 Replacement and patch operations require the read version, refusing missing versions or stale saves without changing the view. | yes | ATS-PFM-QRY-009-10 | TST-PFM-QRY-210 (not-run) |
| CAP-PFM-QRY-009 | BR-CAP-PFM-QRY-009-11 Personal Explorer preferences replace up to twenty pinned views and an opening view against a read version, starting at zero, and retain references without checking whether those views still exist. | yes | ATS-PFM-QRY-009-11 | TST-PFM-QRY-209 (not-run) |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-01 Opening a list record retains an ordered window of matching identities, preserving that window’s order while extensions and rebuilds read results again. | yes | ATS-PFM-QRY-010-01 | |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-02 Navigation starts require a record and ordering, reject result columns or missing inputs, and report a conflict when the record no longer matches. | yes | ATS-PFM-QRY-010-02 | TST-PFM-QRY-208 (not-run) |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-03 Navigation returns position, total and adjacent identities without returning record data. | yes | ATS-PFM-QRY-010-03 | TST-PFM-QRY-208 (not-run) |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-04 Only the initiating person can read a navigation session, and colleagues receive not-found responses even in the same workspace. | yes | ATS-PFM-QRY-010-04 | TST-PFM-QRY-208 (not-run) |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-05 An owner can read retained navigation and return state after losing dataset access, but records outside the retained window lack position and neighbours, and window renewal checks dataset access again. | yes | ATS-PFM-QRY-009-13, ATS-PFM-QRY-010-05, ATS-PFM-QRY-010-13 | TST-PFM-QRY-208 (not-run) |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-06 Navigation scans at most twenty thousand identities and retains at most two thousand in a sliding window, refusing work beyond the scan limit. | yes | ATS-PFM-QRY-010-06 | TST-PFM-QRY-213 (not-run), TST-PFM-QRY-214 (not-run) |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-07 Navigation expires after twelve hours, retains expired return state for seven more days, and removes the owner’s long-expired sessions when a new session is created. | yes | ATS-PFM-QRY-010-07 | TST-PFM-QRY-213 (not-run), TST-PFM-QRY-214 (not-run) |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-08 Joined recipe navigation counts distinct base records for positions and totals. | yes | ATS-PFM-QRY-010-08 | |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-09 Whole-result selection returns ordered record identities and a total without record data, limiting the selection to ten thousand and marking truncation. | yes | ATS-PFM-QRY-010-09 | TST-PFM-QRY-208 (not-run), TST-PFM-QRY-220 (not-run) |
| CAP-PFM-QRY-010 | BR-CAP-PFM-QRY-010-10 Navigation creation and selection require the Explorer permission and dataset access, with matching query refusals applied to both. | yes | ATS-PFM-QRY-010-10 | TST-PFM-QRY-208 (not-run), TST-PFM-QRY-220 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-01 A report’s audience includes its owner, selected-role holders, the workspace for organization sharing, and report managers, with other readers receiving a not-found response. | yes | ATS-PFM-QRY-011-01 | TST-PFM-QRY-233 (not-run), TST-PFM-QRY-335 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-02 Report reading requires read permission, whereas every write requires use permission, preventing Read Only users from creating, copying, saving, sharing or deleting reports. | yes | ATS-PFM-QRY-011-02 | TST-PFM-QRY-050 (not-run), TST-PFM-QRY-231 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-03 Stored-report catalog reads check source-query visibility and base-dataset access for every reader, including managers, without validating the full definition or every joined dataset. | yes | ATS-PFM-QRY-007-13, ATS-PFM-QRY-011-03 | TST-PFM-QRY-074 (not-run), TST-PFM-QRY-231 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-04 A report cannot have a wider audience than its saved query, and selected report roles must be contained in the query’s roles, with the narrower source identified on refusal. | yes | ATS-PFM-QRY-006-18, ATS-PFM-QRY-011-04, ATS-PFM-QRY-011-14, ATS-PFM-QRY-011-15, ATS-PFM-QRY-012-11 | TST-PFM-QRY-023 (not-run), TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-05 Owners and managers maintain reports; owners need share permission for audience changes, managers use manage permission, and an unchanged audience needs neither sharing grant. | yes | ATS-PFM-QRY-011-05 | TST-PFM-QRY-233 (not-run), TST-PFM-QRY-411 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-06 Rhythm staff working under a workspace grant receive report-management powers over private and shared reports, while data-readability filtering still applies. | yes | ATS-PFM-QRY-011-06 | TST-PFM-QRY-068 (not-run), TST-PFM-QRY-411 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-07 An authorized report-use holder can copy a visible report into a new private report they own; Read Only readers cannot create copies. | yes | ATS-PFM-QRY-011-07 | TST-PFM-QRY-335 (not-run), TST-PFM-QRY-411 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-08 Creating or saving a report requires a visible saved-query source, rejecting unseen sources as unavailable. | yes | ATS-PFM-QRY-011-08 | TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-09 Reports have owner-unique case-insensitive names of one to 120 characters, descriptions of at most one thousand characters, one of four kinds and exact stored layouts bounded by 512 KiB. | yes | ATS-PFM-QRY-011-09 | TST-PFM-QRY-322 (not-run), TST-PFM-QRY-359 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-10 Saves carry the read version in their body and deletes supply it as a parameter, rejecting missing versions and conflicting stale changes. | yes | ATS-PFM-QRY-011-10 | TST-PFM-QRY-055 (not-run), TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-11 Report reads flag source definitions changed since the report was saved, and another report save records the latest source versions. | yes | ATS-PFM-QRY-011-11 | TST-PFM-QRY-127 (not-run), TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-12 Report deletion releases its saved-query dependency without deleting the query and pauses dependent schedules atomically. | yes | ATS-PFM-QRY-011-12, ATS-PFM-QRY-011-16, ATS-PFM-QRY-011-17, ATS-PFM-QRY-013-12, ATS-PFM-QRY-015-18 | TST-PFM-QRY-057 (not-run), TST-PFM-QRY-069 (not-run), TST-PFM-QRY-230 (not-run) |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-13 The catalog returns newest-updated reports without layouts in pages of at most one hundred, filtered by scope, name, kind or source query. | no | | |
| CAP-PFM-QRY-011 | BR-CAP-PFM-QRY-011-14 Rhythm’s built-in reports ship in the console rather than stored records, and stored reports have no system-sharing audience. | no | | |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-01 Dashboards are reports without a single direct saved-query source, reject that direct source field, and differ from other report kinds that require it. | yes | ATS-PFM-QRY-012-01 | TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-02 Dashboard saves record up to fifty distinct widget sources in first-widget order and reject larger source sets without writing. | yes | ATS-PFM-QRY-012-02 | TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-03 Every widget source must be visible to the author, and an inaccessible source produces a refusal locating its widget. | yes | ATS-PFM-QRY-012-03 | TST-PFM-QRY-096 (not-run), TST-PFM-QRY-233 (not-run), TST-PFM-QRY-335 (not-run) |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-04 Dashboard audiences cannot exceed any source audience, with the first narrower source in widget order identified. | yes | ATS-PFM-QRY-011-15, ATS-PFM-QRY-012-04, ATS-PFM-QRY-012-11 | TST-PFM-QRY-054 (not-run), TST-PFM-QRY-095 (not-run), TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-05 A query used by a dashboard source cannot be deleted while that dependency remains. | yes | ATS-PFM-QRY-012-05 | TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-06 Dashboard change warnings reflect source-definition changes rather than source renames alone. | yes | ATS-PFM-QRY-012-06 | TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-07 For a source the reader cannot see, dashboard source metadata returns only identity and change state, withholding its name. | yes | ATS-PFM-QRY-012-07 | TST-PFM-QRY-335 (not-run) |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-08 A dashboard with sources passes catalog filtering when at least one visible source has an accessible base dataset; a dashboard without sources also passes. | yes | ATS-PFM-QRY-012-08 | |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-09 Widgets run their own saved queries as the viewer, apply narrowing dashboard filters and fail independently when a source is unavailable. | yes | ATS-PFM-QRY-012-09, ATS-PFM-QRY-012-12, ATS-PFM-QRY-013-13 | TST-PFM-QRY-097 (not-run) |
| CAP-PFM-QRY-012 | BR-CAP-PFM-QRY-012-10 Platform preserves dashboard layout content exactly and interprets only widget source-query identities. | yes | ATS-PFM-QRY-012-10 | TST-PFM-QRY-233 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-01 Report export requires report use and a visible report, returns not found for an inaccessible report and writes nothing for rejected requests. | yes | ATS-PFM-QRY-013-01, ATS-PFM-QRY-013-14, ATS-PFM-QRY-014-12 | TST-PFM-QRY-231 (not-run), TST-PFM-QRY-232 (not-run), TST-PFM-QRY-334 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-02 All report kinds support PDF, only coded and table reports support Excel, and report CSV is rejected. | yes | ATS-PFM-QRY-013-02 | TST-PFM-QRY-334 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-03 Print parameters preserve submitted values and accept at most fifty names, text up to five hundred characters and lists up to one hundred entries, rejecting unsupported values and the renderer’s reserved name. | yes | ATS-PFM-QRY-013-03 | TST-PFM-QRY-334 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-04 Before opening a browser, rendering rechecks the report and requester, failing deleted or newly inaccessible reports and lost report-use access as access lost. | yes | ATS-PFM-QRY-013-04, ATS-PFM-QRY-013-15, ATS-PFM-QRY-015-19 | TST-PFM-QRY-333 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-05 Print-page API calls run internally as the requester through an allowed route set in the export workspace, with other origins, operations and routes refused and logged without query strings. | yes | ATS-PFM-QRY-013-05 | TST-PFM-QRY-409 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-06 Each page request renews its access check, and revoked access fails the export rather than producing a file of refusal messages. | yes | ATS-PFM-QRY-012-12, ATS-PFM-QRY-013-06, ATS-PFM-QRY-013-13 | TST-PFM-QRY-111 (not-run), TST-PFM-QRY-333 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-07 Rendering rejects work beyond five minutes, PDFs above two hundred pages, and invalid or oversized Excel files above one hundred megabytes, without storing a rejected file. | yes | ATS-PFM-QRY-013-07 | TST-PFM-QRY-113 (not-run), TST-PFM-QRY-333 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-08 Completed files use the report name and workspace date and remain available for thirty days. | yes | ATS-PFM-QRY-013-08 | TST-PFM-QRY-333 (not-run), TST-PFM-QRY-334 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-09 Report deletion leaves completed files downloadable but causes queued rendering to fail for lost access. | yes | ATS-PFM-QRY-011-16, ATS-PFM-QRY-013-09, ATS-PFM-QRY-013-12 | TST-PFM-QRY-110 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-10 Rendering uses a fresh browser without a login session or stored credentials, disables service workers and downloads, and rejects page-opened connections. | yes | ATS-PFM-QRY-013-10 | TST-PFM-QRY-027 (not-run), TST-PFM-QRY-112 (not-run), TST-PFM-QRY-409 (not-run) |
| CAP-PFM-QRY-013 | BR-CAP-PFM-QRY-013-11 Internal rendering failures retry through the queue and become a generic final failure on the last attempt. | yes | ATS-PFM-QRY-013-11 | TST-PFM-QRY-333 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-01 Query export uses the same access as query execution with no extra export permission, validating the request before creating an export. | yes | ATS-PFM-QRY-014-01 | TST-PFM-QRY-301 (not-run), TST-PFM-QRY-302 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-02 Exports require exactly one saved-query source with values or an on-screen definition, support CSV or Excel and label, technical-name or absent headings, allow descriptions only in Excel, and default to Excel with labels without descriptions. | yes | ATS-PFM-QRY-014-02 | TST-PFM-QRY-301 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-03 Exports queue asynchronously and read the query engine in pages of one thousand to write its complete result once in its column and row order. | yes | ATS-PFM-QRY-002-19, ATS-PFM-QRY-014-03, ATS-PFM-QRY-014-11 | TST-PFM-QRY-301 (not-run), TST-PFM-QRY-302 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-04 CSV uses UTF-8 with a byte-order mark, CRLF and quoting, calendar dates and workspace-offset instants; Excel retains native value types, and formula-like text is neutralized without altering negative numbers. | yes | ATS-PFM-QRY-014-04 | TST-PFM-QRY-394 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-05 Exports fail with an actionable message above one million CSV rows, Excel’s sheet capacity or fourteen minutes of work. | yes | ATS-PFM-QRY-014-05 | TST-PFM-QRY-302 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-06 Export execution rechecks query access and produces no file when it is lost, while Rhythm staff need a current workspace grant. | yes | ATS-PFM-QRY-014-06 | TST-PFM-QRY-302 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-07 Export status and downloads are available to the requester, the relevant schedule owner and schedule managers; others receive not found, unfinished files return not ready, and expired files return gone. | yes | ATS-PFM-QRY-013-14, ATS-PFM-QRY-014-07, ATS-PFM-QRY-014-12, ATS-PFM-QRY-018-15 | TST-PFM-QRY-108 (not-run), TST-PFM-QRY-301 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-08 Files remain for thirty days under their workspace and export identities, and download redirects last five minutes. | yes | ATS-PFM-QRY-014-08 | TST-PFM-QRY-109 (not-run), TST-PFM-QRY-302 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-09 Personal delivery links need no login, bind workspace, export, recipient and a seven-day expiry, require current recipient membership and an existing file, record downloads, and otherwise return an invalid-link page. | yes | ATS-PFM-QRY-014-09, ATS-PFM-QRY-014-13, ATS-PFM-QRY-015-20 | TST-PFM-QRY-301 (not-run), TST-PFM-QRY-395 (not-run) |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-10 Interactive and scheduled exports use separate queues and concurrency allocations. | no | | |
| CAP-PFM-QRY-014 | BR-CAP-PFM-QRY-014-11 Exported references show their display values with identity columns only when selected, and an empty result still writes headings. | yes | ATS-PFM-QRY-014-10 | TST-PFM-QRY-302 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-01 Schedule access requires the query surface plus schedule use or manage; users reach their own schedules, managers reach all, and other users receive not found. | yes | ATS-PFM-QRY-015-01 | TST-PFM-QRY-147 (not-run), TST-PFM-QRY-349 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-02 Query schedule creation requires a visible compilable source, required values, an active published delivery template, an hourly-or-slower timetable and active organizational user recipients. | yes | ATS-PFM-QRY-015-02 | TST-PFM-QRY-349 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-03 Query schedules run their stored source copy until explicitly refreshed, show later saved-query changes for comparison, and do not silently adopt those edits. | yes | ATS-PFM-QRY-006-19, ATS-PFM-QRY-015-03, ATS-PFM-QRY-015-17 | TST-PFM-QRY-349 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-04 Automatic runs rebuild owner access and stop delivery, fail the run and pause the schedule when the owner cannot execute its source. | yes | ATS-PFM-QRY-015-04 | TST-PFM-QRY-350 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-05 Only schedule managers can take ownership, after which later automatic runs use their access. | yes | ATS-PFM-QRY-015-05 | TST-PFM-QRY-140 (not-run), TST-PFM-QRY-349 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-06 Run Now executes as the initiating person for the existing recipients and can run a paused schedule. | yes | ATS-PFM-QRY-015-06 | TST-PFM-QRY-151 (not-run), TST-PFM-QRY-349 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-07 Schedules accept at most fifty distinct users or addresses, resolve user addresses at send time, skip unavailable users with reasons and require outside-recipient permission for external addresses. | yes | ATS-PFM-QRY-015-07 | TST-PFM-QRY-143 (not-run), TST-PFM-QRY-349 (not-run), TST-PFM-QRY-350 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-08 Each recipient gets one communications request per run with a personal seven-day link, and run-recipient deduplication prevents duplicate e-mails on retry. | yes | ATS-PFM-QRY-014-13, ATS-PFM-QRY-015-08, ATS-PFM-QRY-015-20 | TST-PFM-QRY-350 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-09 Query schedules default to skipping empty results, while report schedules reject that option. | yes | ATS-PFM-QRY-015-09 | TST-PFM-QRY-230 (not-run), TST-PFM-QRY-350 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-10 A scheduled date value stored as today resolves to each run’s workspace day and is recorded on that run’s export. | yes | ATS-PFM-QRY-015-10 | TST-PFM-QRY-349 (not-run), TST-PFM-QRY-350 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-11 Transient errors retry, query and access failures do not, five consecutive failed runs pause the schedule with a reason, and success clears the failure count. | yes | ATS-PFM-QRY-015-11 | TST-PFM-QRY-150 (not-run), TST-PFM-QRY-350 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-12 Report schedules require report use and visibility, render the current report as PDF by default or eligible Excel, flag report changes without pinning them and cannot change into query schedules. | yes | ATS-PFM-QRY-013-15, ATS-PFM-QRY-015-12, ATS-PFM-QRY-015-19 | TST-PFM-QRY-230 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-13 Report deletion atomically pauses its schedules as report deleted, preserves their history and permits only their deletion rather than resumption or another run. | yes | ATS-PFM-QRY-011-17, ATS-PFM-QRY-015-13, ATS-PFM-QRY-015-18 | TST-PFM-QRY-142 (not-run), TST-PFM-QRY-230 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-14 Imported legacy schedules start paused and require confirmation that the legacy schedule is disabled before resuming. | yes | ATS-PFM-QRY-015-14 | TST-PFM-QRY-349 (not-run) |
| CAP-PFM-QRY-015 | BR-CAP-PFM-QRY-015-15 Schedule edits use the read version, duplication creates a paused caller-owned copy, and deletion removes runs and deliveries while exported files retain their expiry. | yes | ATS-PFM-QRY-015-15 | TST-PFM-QRY-139 (not-run), TST-PFM-QRY-349 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-01 Search access requires the lookup permission and each requested type’s read permission, refusing the entire request and provisioning nothing when any type is unauthorized. | yes | ATS-PFM-QRY-016-01 | TST-PFM-QRY-417 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-02 Organization search currently uses contact-read access rather than organization-read access, granting contact readers and refusing holders of organization read alone. | yes | ATS-PFM-QRY-016-02 | TST-PFM-QRY-417 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-03 Search credentials are request-specific signed keys confined to one index, workspace, live documents and permitted record types, rate-limited per person for fifteen minutes with renewal at eighty percent of their life. | yes | ATS-PFM-QRY-016-03, ATS-PFM-QRY-016-13, ATS-PFM-QRY-017-13 | TST-PFM-QRY-417 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-04 Credential filters cannot be widened by the browser, but leave discovery filtering to the browser so including inactive records changes status visibility only. | yes | ATS-PFM-QRY-016-04 | TST-PFM-QRY-417 (not-run), TST-PFM-QRY-447 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-05 Permission changes apply on the next credential, leaving at most fifteen minutes of stale search access without individual-key revocation. | no | | |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-06 A record type’s first workspace search creates default indexing configuration and requests initial population, while repeated access requests do not reprovision it. | yes | ATS-PFM-QRY-016-05 | TST-PFM-QRY-417 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-07 Search requests require a nonempty bounded list of distinct registered record types and reject invalid entries with the available types identified. | yes | ATS-PFM-QRY-016-06 | TST-PFM-QRY-417 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-08 An environment without a search provider returns unavailable without secret details, allowing the console to hide its search entry. | yes | ATS-PFM-QRY-016-07 | TST-PFM-QRY-417 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-09 Index discovery markers exclude archived or disallowed-status records from ordinary search until Include inactive records is enabled, and the option resets whenever search opens. | yes | ATS-PFM-QRY-016-08 | TST-PFM-QRY-432 (not-run), TST-PFM-QRY-454 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-10 Phone indexing includes stored text and digits, adding the national ten-digit form for North American numbers. | yes | ATS-PFM-QRY-016-09 | TST-PFM-QRY-454 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-11 Wildcard-only Rhythm staff access is refused by the search route even when the workspace administrator can use it. | yes | ATS-PFM-QRY-016-10 | TST-PFM-QRY-419 (not-run) |
| CAP-PFM-QRY-016 | BR-CAP-PFM-QRY-016-12 The lookup accepts a single non-space character, waits for a brief typing pause, prevents older answers from replacing newer ones, and retains current results while a new search runs; changing a filter searches immediately. | yes | ATS-PFM-QRY-016-12 | TST-PFM-QRY-186 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-01 Settings read, update and rebuild use separate permissions plus dataset query access, with inaccessible record types omitted from the settings list. | yes | ATS-PFM-QRY-017-01 | TST-PFM-QRY-418 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-02 Reading never-configured settings returns default fields, version zero and unprovisioned state without writing. | yes | ATS-PFM-QRY-017-02 | TST-PFM-QRY-418 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-03 Search field configuration accepts one to thirty distinct eligible dataset fields in three tiers, excludes hidden or unsupported content types, and rejects all detected problems together without writing. | yes | ATS-PFM-QRY-017-03 | TST-PFM-QRY-418 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-04 Configuration updates use the read version, leave unchanged lists and versions alone, and atomically record a changed target with the rebuild it requires. | yes | ATS-PFM-QRY-016-13, ATS-PFM-QRY-017-04, ATS-PFM-QRY-017-13 | TST-PFM-QRY-418 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-05 Rebuilding fills a new generation while the existing one serves searches, publishes after validation, and coalesces concurrent full rebuild requests for the same record type. | yes | ATS-PFM-QRY-017-05 | TST-PFM-QRY-423 (not-run), TST-PFM-QRY-445 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-06 Change handling claims record versions before projection, removes documents for missing source records and avoids writing late updates after deletion. | yes | ATS-PFM-QRY-017-06 | TST-PFM-QRY-433 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-07 Organization renames refresh current affiliates, address changes refresh linked contacts, and fan-out beyond two hundred contacts becomes rebuild work. | yes | ATS-PFM-QRY-017-07 | TST-PFM-QRY-433 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-08 A workspace’s provider failure affects only its events, while events for unindexed, deleting or missing workspaces settle without provider writes. | yes | ATS-PFM-QRY-017-08 | TST-PFM-QRY-433 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-09 Retired fields degrade the index and trigger rebuilding without the field while remaining visible as unavailable in configuration, and saves retaining them are rejected. | yes | ATS-PFM-QRY-017-09 | TST-PFM-QRY-418 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-10 Repair resubmits owed rebuilds every fifteen minutes with hourly automatic backoff per type, reconciles types nightly in assigned hours, and retains deletion counters for at least fourteen days. | yes | ATS-PFM-QRY-017-10 | TST-PFM-QRY-435 (not-run), TST-PFM-QRY-438 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-11 Provisioning creates workspace index resources and purge removes them, waits for active rebuilds, and suppresses writes during workspace deletion. | yes | ATS-PFM-QRY-017-11, ATS-PFM-QRY-017-14, ATS-PFM-QRY-017-15, ATS-PFM-QRY-018-16, ATS-PFM-QRY-019-12 | TST-PFM-QRY-439 (not-run) |
| CAP-PFM-QRY-017 | BR-CAP-PFM-QRY-017-12 Provider-setting release changes advance the expected index settings and trigger automatic rebuilds through the repair pass. | no | ATS-PFM-QRY-017-16 | TST-PFM-QRY-438 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-01 Data-export read, manage, execute and download are sensitive administrator permissions excluded from generated policies and granted by the dedicated exporter policy to Administrators rather than Power Users. | yes | ATS-PFM-QRY-018-01 | TST-PFM-QRY-187 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-02 Every export route requires its specific permission independently of the other export permissions and administrator tier. | yes | ATS-PFM-QRY-018-02 | TST-PFM-QRY-187 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-03 Export settings creation and execution admission require a live workspace that is not a sandbox. | yes | ATS-PFM-QRY-018-03 | TST-PFM-QRY-187 (not-run), TST-PFM-QRY-193 (not-run), TST-PFM-QRY-197 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-04 A workspace holds one version-controlled export definition with retention of one to thirty days and at most twenty additional notification users. | yes | ATS-PFM-QRY-018-04 | TST-PFM-QRY-187 (not-run), TST-PFM-QRY-197 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-05 Destinations are limited to five distinct connections with connection-relative paths; adding or enabling one records access widening, and removing one retires its binding. | yes | ATS-PFM-QRY-018-05 | TST-PFM-QRY-200 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-06 Admission queues an export at request time with copied settings, marks allowance consumption except for staff runs, rejects suspended definitions and allows only one queued or running execution per workspace. | yes | ATS-PFM-QRY-018-06 | TST-PFM-QRY-193 (not-run), TST-PFM-QRY-201 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-07 Execution admission records an access-widening export event in the same transaction. | yes | ATS-PFM-QRY-018-07 | TST-PFM-QRY-201 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-08 Package generation and delivery completion are unfinished; download, cancellation, early artifact deletion and delivery retry return not implemented, and a manifest is missing before a package exists. | yes | ATS-PFM-QRY-017-14, ATS-PFM-QRY-018-08, ATS-PFM-QRY-018-15, ATS-PFM-QRY-018-16, ATS-PFM-QRY-018-17, ATS-PFM-QRY-019-13 | TST-PFM-QRY-187 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-09 Rhythm staff cannot use customer-console export routes, while HQ export reads require the staff permission, span workspaces and reject customer administrators. | yes | ATS-PFM-QRY-018-09 | TST-PFM-QRY-187 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-10 Coverage reconciliation adds declarations at a new coverage version, reports unchanged-version shape conflicts without replacing them, and retires or restores declarations as releases remove or reintroduce them. | yes | ATS-PFM-QRY-018-10 | TST-PFM-QRY-194 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-11 An execution from another workspace is reported as missing. | yes | ATS-PFM-QRY-018-11 | TST-PFM-QRY-187 (not-run) |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-12 The product should require a sign-in within fifteen minutes for package downloads and destination changes. | yes | ATS-PFM-QRY-018-12 | |
| CAP-PFM-QRY-018 | BR-CAP-PFM-QRY-018-13 The product should apply export allowances per workspace, with workspace-specific or customer-wide overrides. | yes | ATS-PFM-QRY-018-13 | |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-01 Workspace period reads list each month once newest first using its current or highest version, with status, basis, publication or skip detail, and reject users from another customer. | yes | ATS-PFM-QRY-019-01 | TST-PFM-QRY-467 (not-run), TST-PFM-QRY-473 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-02 HQ snapshot operations are staff-only, separate read permission from run and policy management, and refuse customer administrators. | yes | ATS-PFM-QRY-019-02 | TST-PFM-QRY-467 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-03 Snapshot periods follow the workspace’s own time zone and identify the month described. | yes | ATS-PFM-QRY-019-03 | TST-PFM-QRY-472 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-04 Planning includes active eligible workspaces, skips loading or disabled workspaces with recorded reasons, and applies type-specific policy ahead of workspace-wide policy and defaults. | yes | ATS-PFM-QRY-019-04 | TST-PFM-QRY-472 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-05 Manual reruns allocate a new period version and reject overlapping active runs, while back-fill skips existing months unless supersession is requested. | yes | ATS-PFM-QRY-019-05 | TST-PFM-QRY-467 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-06 Validation and publication commit together, leaving no rows or current-version change after failure and preserving earlier versions when a rerun publishes. | yes | ATS-PFM-QRY-019-06 | TST-PFM-QRY-472 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-07 The shared snapshot ledger restricts application writers to their own service’s runs and denies deletion. | yes | ATS-PFM-QRY-019-07 | TST-PFM-QRY-468 (not-run), TST-PFM-QRY-471 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-08 The database permits only one active run and one current version per workspace, snapshot type and period. | yes | ATS-PFM-QRY-019-08 | TST-PFM-QRY-471 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-09 Failed snapshots retry after fifteen minutes, one hour and four hours, stop after a fourth failure, and raise overdue alarms when publication misses its deadline. | yes | ATS-PFM-QRY-019-09 | |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-10 Snapshot requests require a reason, valid month and configured type, with run pages capped at one thousand. | yes | ATS-PFM-QRY-019-10 | TST-PFM-QRY-467 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-11 Workspace purge removes every snapshot version, run and policy override for that workspace. | yes | ATS-PFM-QRY-017-15, ATS-PFM-QRY-018-17, ATS-PFM-QRY-019-11, ATS-PFM-QRY-019-12, ATS-PFM-QRY-019-13 | TST-PFM-QRY-472 (not-run) |
| CAP-PFM-QRY-019 | BR-CAP-PFM-QRY-019-12 Requests create ledger work that each owning application admits through its own dispatcher, capped at four concurrent runs including at most one back-fill. | no | ATS-PFM-QRY-019-14 | |
| CAP-PFM-QRY-020 | BR-CAP-PFM-QRY-020-01 Only a system caller can evaluate conditions over named records; a user caller is refused. | yes | ATS-PFM-QRY-020-01 | TST-PFM-QRY-266 (not-run) |
| CAP-PFM-QRY-020 | BR-CAP-PFM-QRY-020-02 An evaluation accepts one to one thousand nonblank subject ids and one to one hundred predicates with distinct nonblank names; invalid lists or incompatible predicate options are refused. | yes | ATS-PFM-QRY-020-02 | |
| CAP-PFM-QRY-020 | BR-CAP-PFM-QRY-020-03 Boolean conditions preserve an unknown result for missing facts by default, while the alternate null policy evaluates them using the ordinary query filter’s meaning. | yes | ATS-PFM-QRY-020-03 | TST-PFM-QRY-266 (not-run) |
| CAP-PFM-QRY-020 | BR-CAP-PFM-QRY-020-04 Collection calculations support count, sum, minimum and maximum; empty collections give zero for count and sum and no value for minimum and maximum. | yes | ATS-PFM-QRY-020-04 | |
| CAP-PFM-QRY-020 | BR-CAP-PFM-QRY-020-05 A supplied evaluation day anchors relative dates in the workspace calendar, including calendar shifts; invalid days and date tokens used on unsuitable fields are refused. | yes | ATS-PFM-QRY-020-05, ATS-PFM-QRY-020-07 | TST-PFM-QRY-266 (not-run) |
| CAP-PFM-QRY-020 | BR-CAP-PFM-QRY-020-06 Evaluation reads only the named records in the current workspace through a read-only database role, and its logs omit subject ids, fact values and query text. | yes | ATS-PFM-QRY-020-06 | |