The suite connects owned definitions, release-managed built-ins, derived assignments and enforced requests. It establishes a regression baseline for how changes in permission sources reach the final authorization decision.
A definition change can alter every holder’s fresh request result. A derived assignment can expire independently of the signed context that previously carried it. The interaction rows identify the participating capabilities and the detailed proofs they assume. A complete feature chain needs its own executable evidence even when its individual outcomes already have bindings.
A customer administrator can compose an unreferenced custom role.
Steps
[object Object]
Expected
The saved definition persists and its archived identity leaves the active list.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
react-console:e2e/security/roles.spec.ts#is created from a name and a permission,react-console:e2e/security/roles.spec.ts#is on the Roles list, searchable, and marked custom,react-console:e2e/security/roles.spec.ts#is edited, and the change survives a reload,react-console:e2e/security/roles.spec.ts#is given to a person, who then shows on its Members tab,react-console:e2e/security/roles.spec.ts#is archived once nobody holds it, and leaves the active list,react-console:e2e/security/roles.spec.ts#refuses to archive a role somebody still holds, and names them,react-console:e2e/security/roles.spec.ts#shows a built-in role read-only, and duplicates it into one that can be changed
A role references a policy and an active member holds it.
Steps
[object Object]
Expected
The new materialized permissions constrain requests while shared definitions retain their ownership.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/integration/services/definitions/manage-roles.integration.spec.js#refuses a reference to another customer's policy, and writes no role at all,services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#grants a newly shipped built-in to nobody: no role references it,services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#lists only the tenants a grant could reach, not every tenant of the customer
03A withdrawn built-in returns with the same identitylifecycleproposed
A published built-in has holders and a separate customer copy.
Steps
[object Object]
Expected
The built-in identity returns, the customer copy stays separate, and fresh requests follow the currently published content.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses a write against a built-in as read-only rather than as a record that is not there,services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#renames a key through formerKeys, keeping the row and every reference to it,services-platform:modules/security/tests/unit/authorizer/registry-manifest.spec.ts#refuses a staffOnly key below a system route
04Customer edits cannot alter staff or source-owned authoritypermissionnegativeproposed
A customer administrator can edit customer roles and has a derived assignment in view.
Steps
[object Object]
Expected
Each operation is refused within its distinct authority boundary.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#lists every role but the staff-only ones, the built-ins a customer assigns among them,services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses an amendment 409 derived_assignment, naming where to change it,services-platform:modules/security/tests/e2e/staff-separation.e2e.spec.js#refuses the widest grant Rhythm holds, every one of them
05Expired derived access cannot survive in an earlier contextregressionnegativeproposed
A portal contact has a derived assignment whose end precedes the retained context expiry.
Steps
[object Object]
Expected
The stored validity boundary stops derived authority even while the context remains otherwise valid.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/e2e/derived-assignments.e2e.spec.js#refuses the same still-unexpired context once valid_until has passed, because validity is read per request,services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the context expires at iat + the gateway TTL + 30 s and carries no IP address