01must proveProposed | Query generation requires its own permission, independently of query-reading access, and a caller lacking that permission is refused. | permission | api | test |
02must proveProposed | Generation requires access to the requested dataset, rejecting unauthorized datasets and reporting unregistered datasets as missing. | permission | service | test |
03must proveProposed | Generation accepts bounded, nonempty written text and returns the same validation code for empty, oversized or non-text requests. | validation | api | test |
04must proveProposed | A generation request returns a record to poll, which only its initiating person can read within the originating workspace. | policy | service | test |
05must proveProposed | A generated query runs through ordinary execution as the requester and therefore cannot expand that person’s access. | invariant | service | test |
06must proveProposed | An exhausted organizational AI allowance refuses the request immediately with the required and remaining amounts. | policy | service | test |
07must proveProposed | Each request records one metered organizational invocation while withholding model and cost details from its requester. | calculation | service | test |
08Proposed | Generation may return clarification and interpretations without providing a query. | policy | service | test |
09must proveProposed | Refinement creates a separate generation linked to its predecessor and rejects a predecessor still in progress. | validation | service | test |
10must proveProposed | An organization at its simultaneous-call limit receives a retry-later generation failure, with the refused invocation’s reason recorded. | policy | service | test |
11must proveProposed | The recovery sweep fails work still unsettled after the worker timeout and margin, preserves an existing verdict, and deletes request and outcome records older than thirty days. | policy | service | test |
12must proveProposed | Generation rejects invalid or inaccessible query context before creating work; failure to invoke the worker settles the admitted generation as failed instead of leaving it working. | validation | service | test |