The coverage map distinguishes a dedicated scenario from an unresolved category. Proposed scenarios define proof to build; bindings retain the exact assertion references and identify their executable suite.
Prepare an active principal and an authorized manager and reader.
Steps
Suspend twice, resume and attempt management as the reader.
Expected
The first suspension advances the version and creates one event; the repeat creates none. Resumption records widening, and the reader cannot manage status.
Use an isolated service principal in active state, with the required authority and guard fixtures.
Steps
[
{
"do": "Suspend the registered caller as authorized staff and inspect status history.",
"expect": "Read the resulting service principal as suspended; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/service-principals/principal-status.ts",
"services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1."
]
}
]
Expected
Read the resulting service principal as suspended; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Use an isolated service principal in suspended state, with the required authority and guard fixtures.
Steps
[
{
"do": "Resume the registered caller as authorized staff and inspect widening history.",
"expect": "Read the resulting service principal as active; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/service-principals/principal-status.ts",
"services-platform at ad3f6a65: modules/security/db/service-principals.table.ts; services/service-principals/principal-status.ts, registered-principals.ts; services/provisioning/ensure-service-principals.ts; docs/proposals/service-principals.md §8.1."
]
}
]
Expected
Read the resulting service principal as active; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
A customer administrator, a staff reader and a Rhythm Administrator are available.
Steps
Read the principal register and attempt suspension with each identity.
Expected
Only authorized staff can read it and only the management key permits suspension.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#refuses an administrator of a customer, holding every key at that customer, as 403,services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a customer's administrator 403, holding every key of their own customer