Skip to content

CAP-PFM-QRY-004Answer operational questions across customers

Markdown

CAP-PFM-QRY-004

Answer operational questions across customers

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-QRY-01
Exercised by
FAS-PFM-QRY-01-04
Key concepts
CON-PFM-QRY-001
Actors
ACT-PFM-015
Depends on
CAP-PFM-QRY-001
Related
CAP-PFM-QRY-002, CAP-PFM-QRY-005
Proved by
ATS-PFM-QRY-004

Implementation

Executable suites
TST-PFM-QRY-228, TST-PFM-QRY-235

KindCapabilityProduct areaPlatformModuleQuestions, record exploration and data deliveryRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
HQ investigation can span customers.System questions stay separate from customer records.
Surfaces
consoleapi

Controls

16 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-IAM-003 TC-LOG-001 TC-LOG-005 TC-PI-001 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.queries.readapiglobal
each system dataset's own key (hq.customers.read, hq.tenants.read, hq.jobs.read, hq.staff.read, hq.llm-usage.read)serviceglobal

Business Rules

8 rules, 7 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
Rhythm HQ queries require both the system-query permission and the chosen system dataset’s permission; the surface permission alone leaves every dataset unauthorized.
permissionapi, servicetest
services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers every dataset as unauthorized for a caller holding the surface key alone
02must prove
Proposed
The system catalog exposes only HQ datasets and treats workspace datasets requested there as missing.
invariantservicetest
services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a tenant dataset as one that does not exist, with 404 and never 403
03must prove
Proposed
System datasets and their single-hop references read across customers without a workspace restriction.
policyservicetest
services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers the tenants of every customer at once, which no tenant route could ever do
04must prove
Proposed
A system query cannot join a workspace dataset into its system model.
validationservicetest
services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a model that joins a tenant’s dataset to the system’s, the two having no tenant in common
05must prove
Proposed
System datasets offer the all-records scope without workspace custom fields or label overrides and reject Recently Viewed.
validationservicetest
services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses the recently_viewed scope: it answers what a person viewed in a tenant, and this dataset has none
06must prove
Proposed
System and workspace recipe libraries remain separate, and either surface reports the other’s recipes as missing.
invariantservicetest
services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a tenant’s recipe as one that does not exist, with 404
07must prove
Proposed
A workspace’s AI request records cannot be queried through the HQ system surface.
invariantservicetest
services-platform:modules/queries/tests/e2e/llm-usage.e2e.spec.js#keeps the organization’s requests out of a staff query on the system surface, with 404
08
Proposed
HQ permissions are reserved for Rhythm staff and cannot be granted to customer users at any scope.
permissionapiobserved

Scenarios

IdGivenWhenThenProvenance
01A Rhythm support user holds the HQ reader policy.They query workspaces with the associated customer names.The result spans customers on the system surface.test
services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers a tenant beside its customer’s name, the one-hop join compiled without a tenant predicate

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.