Rhythm 2.0 Specifications

Specifications Security, Customers and Workspaces

Verification

20 acceptance test sets for MOD-PFM-SEC, one per capability, holding 338 scenarios — 209 of them already bound to an existing test. A scenario names the rules and journey assertions it proves; it never restates them.

FEAT-PFM-SEC-01 Customer and Workspace Administration 4

Acceptance test set	Proves capability	Scenarios	Bound	Negative	Levels	Status
`ATS-PFM-SEC-001`	Establish and administer a customer	14	10	8	13 api · 1 unit	Proposed
`ATS-PFM-SEC-002`	Maintain workspace information and operating status	24	13	15	22 api · 1 unit · 1 browser	Proposed
`ATS-PFM-SEC-003`	Prepare a workspace for customer use	24	14	11	23 api · 1 browser	Proposed
`ATS-PFM-SEC-004`	Manage a workspace retirement request	26	11	10	25 api · 1 unit	Proposed

FEAT-PFM-SEC-02 Console Entry and Sessions 3

Acceptance test set	Proves capability	Scenarios	Bound	Negative	Levels	Status
`ATS-PFM-SEC-005`	Join through an invitation	20	12	8	16 api · 1 unit · 3 browser	Proposed
`ATS-PFM-SEC-006`	Use and recover a console sign-in	13	10	9	5 browser · 2 unit · 6 api	Proposed
`ATS-PFM-SEC-007`	Understand available workspace access	16	13	11	13 api · 3 browser	Proposed

FEAT-PFM-SEC-03 People and Access Administration 4

Acceptance test set	Proves capability	Scenarios	Bound	Negative	Levels	Status
`ATS-PFM-SEC-008`	Offer and manage an invitation	22	11	12	19 api · 2 unit · 1 browser	Proposed
`ATS-PFM-SEC-009`	Maintain console memberships	20	11	11	17 api · 2 unit · 1 browser	Proposed
`ATS-PFM-SEC-010`	Assign roles within a controlled scope	22	13	14	21 api · 1 browser	Proposed
`ATS-PFM-SEC-011`	Review security changes and refused attempts	10	6	5	10 api	Proposed

FEAT-PFM-SEC-04 Access Definitions and Authorization 4

Acceptance test set	Proves capability	Scenarios	Bound	Negative	Levels	Status
`ATS-PFM-SEC-012`	Model customer responsibilities with roles and policies	18	13	14	16 api · 1 unit · 1 browser	Proposed
`ATS-PFM-SEC-013`	Publish shared access definitions from releases	15	11	7	9 api · 6 unit	Proposed
`ATS-PFM-SEC-014`	Derive member access from appointments and eligibility	13	10	12	13 api	Proposed
`ATS-PFM-SEC-015`	Enforce access at request boundaries	15	11	14	8 unit · 7 api	Proposed

FEAT-PFM-SEC-05 Staff Administration and Customer Entry 3

Acceptance test set	Proves capability	Scenarios	Bound	Negative	Levels	Status
`ATS-PFM-SEC-016`	Administer Rhythm staff memberships	10	6	6	9 api · 1 browser	Proposed
`ATS-PFM-SEC-017`	Control staff access to customer workspaces	21	13	12	20 api · 1 browser	Proposed
`ATS-PFM-SEC-018`	Suspend and resume service principals	9	5	6	9 api	Proposed

FEAT-PFM-SEC-06 Portal Membership and Identity 2

Acceptance test set	Proves capability	Scenarios	Bound	Negative	Levels	Status
`ATS-PFM-SEC-019`	Register and authenticate portal members	13	8	10	9 api · 4 unit	Proposed
`ATS-PFM-SEC-020`	Match portal memberships to CRM contacts	13	8	7	11 api · 2 unit	Proposed