01must proveConfirmed | Data-export read, manage, execute and download are sensitive administrator permissions excluded from generated policies and granted by the dedicated exporter policy to Administrators rather than Power Users. | permission | api | test |
02must proveConfirmed | Every export route requires its specific permission independently of the other export permissions and administrator tier. | permission | api | test |
03must proveConfirmed | Export settings creation and execution admission require a live workspace that is not a sandbox. | policy | service | test |
04must proveConfirmed | A workspace holds one version-controlled export definition with retention of one to thirty days and at most twenty additional notification users. | validation | service, database | test |
05must proveConfirmed | Destinations are limited to five distinct connections with connection-relative paths; adding or enabling one records access widening, and removing one retires its binding. | validation | service | test |
06must proveConfirmed | Admission queues an export at request time with copied settings, marks allowance consumption except for staff runs, rejects suspended definitions and allows only one queued or running execution per workspace. | policy | service, database | test |
07must proveConfirmed | Execution admission records an access-widening export event in the same transaction. | invariant | service | test |
08must proveConfirmed | Package generation and delivery completion are unfinished; download, cancellation, early artifact deletion and delivery retry return not implemented, and a manifest is missing before a package exists. | lifecycle | api | test |
09must proveConfirmed | Rhythm staff cannot use customer-console export routes, while HQ export reads require the staff permission, span workspaces and reject customer administrators. | permission | api | test |
10must proveConfirmed | Coverage reconciliation adds declarations at a new coverage version, reports unchanged-version shape conflicts without replacing them, and retires or restores declarations as releases remove or reintroduce them. | lifecycle | service | test |
11must proveConfirmed | An execution from another workspace is reported as missing. | permission | service | test |
12must proveConfirmed | The product should require a sign-in within fifteen minutes for package downloads and destination changes. | policy | api | documented |
13must proveConfirmed | The product should apply export allowances per workspace, with workspace-specific or customer-wide overrides. | calculation | service | documented |