The category map records specified proof. A covered category can contain proposed scenarios; it does not mean the checks have run. The bindings identify individual executable contributions, while findings retain missing rules, permissions, transitions and assertions.
The interaction scenarios connect this capability to the related actions and workflow handoffs named in their proof references. Each case observes the outcome after the connected action changes records or available authority. A collection of separately bound checks does not establish an ordered feature journey.
Source revisions and assertion references are recorded in frontmatter. Steps and expected observations carry separate evidence annotations. Proposed checks remain distinct from executable test statements, and static review supplies no run result.
Coverage
Rulegap: FND-PFM-SEC-074
Transitioncovered
Validationcovered
Permissioncovered
Edgegap: FND-PFM-SEC-074
Failuregap: FND-PFM-SEC-074
Boundarycovered
Concurrencygap: FND-PFM-SEC-074
Invariantcovered
Interactioncovered
Test Scenarios
21 scenarios proving CAP-PFM-SEC-017; 13 bound to an existing test.
01Require the grant behind cross-customer assignmentsinvariantapinegativetest
Prepare administrators, Support and multiple customers.
Steps
Add and remove the administrator role, suspend a holder, create a customer through the tested service and request emergency access where standing access exists.
Expected
Create the expected grants outside Rhythm’s customer, revoke them on lifecycle changes and submit flush requests. Reject redundant emergency access. The binding does not establish HQ customer-create reconciliation.
Prepare a run-owned staff access grant in requested state with the authority and inputs required by the cited transition.
Steps
[
{
"do": "Approve the request within its requested duration and inspect the matching assignment.",
"expect": "After the stated action, observe the staff access grant in active state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/staff-access/decide-tenant-access.ts",
"services-platform at ad3f6a65: modules/security/db/staff-access-grants.table.ts; services/staff-access/*; docs/hq/rhythm-hq-plan.md §D2."
]
}
]
Expected
After the stated action, observe the staff access grant in active state. This case does not require an additional history event unless the transition explicitly defines one.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/staff-access/decide-tenant-access.ts,services-platform at ad3f6a65: modules/security/db/staff-access-grants.table.ts; services/staff-access/*; docs/hq/rhythm-hq-plan.md §D2.
15Staff access grant: requested to declinedtransitionapiproposed
Prepare a run-owned staff access grant in requested state with the authority and inputs required by the cited transition.
Steps
[
{
"do": "Decline one request as a customer administrator and withdraw another as its staff requester.",
"expect": "After the stated action, observe the staff access grant in declined state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/staff-access/request-tenant-access.ts:withdrawAccessRequest",
"services-platform at ad3f6a65: modules/security/db/staff-access-grants.table.ts; services/staff-access/*; docs/hq/rhythm-hq-plan.md §D2."
]
}
]
Expected
After the stated action, observe the staff access grant in declined state. This case does not require an additional history event unless the transition explicitly defines one.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/staff-access/request-tenant-access.ts:withdrawAccessRequest,services-platform at ad3f6a65: modules/security/db/staff-access-grants.table.ts; services/staff-access/*; docs/hq/rhythm-hq-plan.md §D2.
16Staff access grant: active to expiredtransitionapiproposed
Prepare a run-owned staff access grant in active state with the authority and inputs required by the cited transition.
Steps
[
{
"do": "Advance to expiry and inspect both fresh access and the lazily settled grant.",
"expect": "After the stated action, observe the staff access grant in expired state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/staff-access-grants.ts:settleExpiredStaffAccessGrants",
"services-platform at ad3f6a65: modules/security/db/staff-access-grants.table.ts; services/staff-access/*; docs/hq/rhythm-hq-plan.md §D2."
]
}
]
Expected
After the stated action, observe the staff access grant in expired state. This case does not require an additional history event unless the transition explicitly defines one.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/persistence/staff-access-grants.ts:settleExpiredStaffAccessGrants,services-platform at ad3f6a65: modules/security/db/staff-access-grants.table.ts; services/staff-access/*; docs/hq/rhythm-hq-plan.md §D2.
17Staff access grant: active to revokedtransitionapiproposed
Prepare a run-owned staff access grant in active state with the authority and inputs required by the cited transition.
Steps
[
{
"do": "Revoke the active grant and inspect its assignment, history and flush submission.",
"expect": "After the stated action, observe the staff access grant in revoked state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/staff-access/end-access-grant.ts",
"services-platform at ad3f6a65: modules/security/db/staff-access-grants.table.ts; services/staff-access/*; docs/hq/rhythm-hq-plan.md §D2."
]
}
]
Expected
After the stated action, observe the staff access grant in revoked state. This case does not require an additional history event unless the transition explicitly defines one.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/staff-access/end-access-grant.ts,services-platform at ad3f6a65: modules/security/db/staff-access-grants.table.ts; services/staff-access/*; docs/hq/rhythm-hq-plan.md §D2.
18Control staff access to customer workspaces with understand available workspace accessinteractionapinegativeproposed
A staff member has customer-level standing access but lacks a permission being delegated.
Steps
Attempt to grant that permission through customer security administration.
Expected
Standing entry does not bypass widening checks; the unavailable delegation is refused without an assignment.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#refuses a scope the caller does not manage, and says which scope rather than which role,services-platform:modules/security/tests/integration/services/staff-access/staff-customer-administration.integration.spec.js#refuses staff withdrawing that administrator’s grant, as a lockout
20Control staff access to customer workspaces with administer rhythm staff membershipsinteractionapiproposed
A Rhythm Administrator has standing access to a customer.
Steps
Suspend the staff membership and inspect customer entry and its standing assignments; reinstate through authorized staff administration.
Expected
Suspension ends usable customer entry; fresh access follows the retained or reconciled assignment state rather than staff status alone.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/aws/api/hq-staff.routes.ts:hqStaffRoutes,services-platform:modules/security/tests/integration/services/staff-access/rhythm-administrator-standing-access.integration.spec.js#gives each Rhythm Administrator one active customer-level standing grant in every customer but Rhythm’s own
21Control staff access to customer workspaces with establish and administer a customerinteractionapiproposed