The coverage map distinguishes a dedicated scenario from an unresolved category. Proposed scenarios define proof to build; bindings retain the exact assertion references and identify their executable suite.
Offer and manage an invitation: Revoke the membership, inspect the old offer, and invite the same address again.
Assign roles within a controlled scope: Try withdrawing the qualifying assignment and suspending its holder; read membership and assignments after each refusal.
Review security changes and refused attempts: Delete the member and read security history with explanation permission.
Administer Rhythm staff memberships: Attempt a removal that would strand each administration boundary.
Coverage
Rulegap: FND-PFM-SEC-066
Transitioncovered
Validationcovered
Permissiongap: FND-PFM-SEC-066
Edgegap: FND-PFM-SEC-066
Failurecovered
Boundarycovered
Concurrencycovered
Invariantcovered
Interactioncovered
Test Scenarios
20 scenarios proving CAP-PFM-SEC-009; 11 bound to an existing test.
01Check customer user-list scope and paginationboundaryapinegativetest
Prepare an active member and the administrator’s own identity.
Steps
Suspend the member, inspect the lifecycle result and try self-suspension.
Expected
Outstanding invitations are withdrawn, successful pool disablement is reported and a flush job is submitted; self-suspension fails. Job submission does not establish cache eviction.
Use an isolated membership status in active state, with the required authority and guard fixtures.
Steps
[
{
"do": "Suspend the active member and inspect post-commit provider synchronization separately.",
"expect": "Read the resulting membership status as suspended; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/invitations/suspend-user.ts",
"services-platform at ad3f6a65: modules/security/db/users.table.ts; services/invitations/accept-invitation.ts, activate-user.ts, invite-user.ts, revoke-user.ts, suspend-user.ts, resend-invitation.ts, user-deletion.ts; services/membership/lockout.ts, last-administrator.ts."
]
}
]
Expected
Read the resulting membership status as suspended; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Use an isolated membership status in suspended state, with the required authority and guard fixtures.
Steps
[
{
"do": "Reinstate the suspended member with authority covering all retained assignments.",
"expect": "Read the resulting membership status as active; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/invitations/suspend-user.ts",
"services-platform at ad3f6a65: modules/security/db/users.table.ts; services/invitations/accept-invitation.ts, activate-user.ts, invite-user.ts, revoke-user.ts, suspend-user.ts, resend-invitation.ts, user-deletion.ts; services/membership/lockout.ts, last-administrator.ts."
]
}
]
Expected
Read the resulting membership status as active; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Use an isolated membership status in active state, with the required authority and guard fixtures.
Steps
[
{
"do": "Revoke the active member and inspect assignment, invitation and queued removal records.",
"expect": "Read the resulting membership status as revoked; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/invitations/revoke-user.ts",
"services-platform at ad3f6a65: modules/security/db/users.table.ts; services/invitations/accept-invitation.ts, activate-user.ts, invite-user.ts, revoke-user.ts, suspend-user.ts, resend-invitation.ts, user-deletion.ts; services/membership/lockout.ts, last-administrator.ts."
]
}
]
Expected
Read the resulting membership status as revoked; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Use an isolated membership status in suspended state, with the required authority and guard fixtures.
Steps
[
{
"do": "Revoke the suspended member and inspect queued provider removal.",
"expect": "Read the resulting membership status as revoked; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/invitations/revoke-user.ts",
"services-platform at ad3f6a65: modules/security/db/users.table.ts; services/invitations/accept-invitation.ts, activate-user.ts, invite-user.ts, revoke-user.ts, suspend-user.ts, resend-invitation.ts, user-deletion.ts; services/membership/lockout.ts, last-administrator.ts."
]
}
]
Expected
Read the resulting membership status as revoked; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Use an isolated invitation in live state, with the required authority and guard fixtures.
Steps
[
{
"do": "Suspend or revoke the membership and attempt to use its outstanding link.",
"expect": "Read the resulting invitation as revoked; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/invitations.ts:revokeOutstandingInvitations",
"services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts."
]
}
]
Expected
Read the resulting invitation as revoked; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/persistence/invitations.ts:revokeOutstandingInvitations,services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts.
17Maintain console memberships with offer and manage an invitationinteractionapinegativeproposed
Only one active qualifying customer administrator remains.
Steps
Try withdrawing the qualifying assignment and suspending its holder; read membership and assignments after each refusal.
Expected
Both operations leave the active administrator and qualifying assignment intact.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/services/membership/lockout.ts:assertNotLockedOut,services-platform:modules/security/tests/integration/services/membership/manage-assignments.integration.spec.js#revokes the grant, keeps the row, and audits what was withdrawn
19Maintain console memberships with review security changes and refused attemptsinteractionapiproposed
A customer administrator and a sole Rhythm Administrator each have active memberships.
Steps
Attempt a removal that would strand each administration boundary.
Expected
Each removal is refused within its own boundary without treating one administrator as the other boundary’s replacement.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/services/membership/lockout.ts:assertNotLockedOut,services-platform:modules/security/tests/integration/services/invitations/delete-user.integration.spec.js#refuses the delete as the staff guard does, naming its machine code