Bite 30L.3 — Manual Promotion Test Suite - RodrigoMattosoSilveira/EnterpriseRemoteSystems GitHub Wiki

Bite 30L.3 — Manual Promotion Test Suite

Bite: 30L.3 — Control Plane, Support Lease & Audit Attribution E2E
Branch: 822-30L3
Current known HEAD: 71ea6111d4abe0947f4975c2eae90cb1b09f654d

Purpose

Manually verify before promotion that Bite 30L.3 correctly enforces:

Application Administrator GLOBAL-only identity before support access;
Tenant Support Access Lease request;
exact-Tenant approval;
wrong-Tenant approval isolation;
Application Administrator self-approval denial;
temporary lease-backed Tenant access;
exact permission allowlisting;
identity non-mutation;
immediate termination;
natural expiration;
exact Account / Actor / Tenant / Lease / Session / Correlation audit attribution;
correct human-readable authorization-source attribution.

Promotion Rule

Promote Bite 30L.3 only if all tests PASS in full.

Any of the following is promotion-blocking:

the Application Administrator acquires an ordinary Tenant Actor;
the Application Administrator acquires a Person or Membership because of support access;
a pending lease makes a Tenant selectable;
the wrong Tenant Administrator can see or approve another Tenant's support request;
the Application Administrator can approve its own request;
an approved lease appears as an ordinary Tenant identity instead of temporary support access;
support access reaches a Tenant other than the exact leased Tenant;
the leased session receives permissions that were not requested;
termination does not remove access immediately;
expiration does not remove access automatically;
termination changes the immutable fixed expiration;
audit events cannot be attributed to the correct Account, Actor, Tenant, Lease, Session, Correlation, and authorization source;
expiration creates a fictitious Actor-attributed lifecycle event;
any unexpected 500 Internal Server Error occurs.

0. Prerequisites and Deterministic LOCAL Environment

0.1 Confirm the source being promoted

From the repository root:

git rev-parse HEAD

For the current known revision, expected:

71ea6111d4abe0947f4975c2eae90cb1b09f654d

If you commit anything after this test suite was written, record the actual final SHA instead:

Final SHA tested:
________________________________________

PASS

The SHA is the exact commit intended for promotion.

BLOCK PROMOTION

Do not continue if testing an uncommitted or different source tree.

0.2 Run automated validation first

From the repository root:

make local-check

Expected:

backend tests pass;
frontend unit tests pass;
Playwright tests pass;
migration checks pass;
local integrity checks pass.

PASS

make local-check exits successfully.

BLOCK PROMOTION

Stop if make local-check reports any failure.

0.3 Start the isolated manual database

Stop any existing local backend first.

From the repository root:

ERS_DATABASE_PATH=data/manual-30l3.db \
ERS_RESET_DATABASE=true \
ERS_PROVISION_E2E_ADMIN=true \
AUTHZ_BOOTSTRAP_ENABLED=false \
[email protected] \
E2E_ADMIN_PASSWORD='Local-E2E-Administrator-28D!' \
E2E_TENANT_ADMIN_PASSWORD='Local-E2E-Administrator-28D!' \
make local-backend

Leave this terminal running.

Important

Use:

ERS_RESET_DATABASE=true

only at the beginning of the complete suite.

Tests 02 and 03 depend on the leases created during Test 01.

If the backend must be restarted after Test 01, restart it without resetting the database:

ERS_DATABASE_PATH=data/manual-30l3.db \
ERS_PROVISION_E2E_ADMIN=true \
AUTHZ_BOOTSTRAP_ENABLED=false \
[email protected] \
E2E_ADMIN_PASSWORD='Local-E2E-Administrator-28D!' \
E2E_TENANT_ADMIN_PASSWORD='Local-E2E-Administrator-28D!' \
make local-backend

Do not reset manual-30l3.db between Tests 01, 02, and 03.

0.4 Start the frontend

In a second terminal:

make local-frontend

Leave it running.

0.5 Run the GLOBAL-context preflight

In a third terminal:

make local-30l3-global-context-check

Expected ending:

PASS: backend and frontend proxy both expose only Global administration before any Support Access Lease is approved.

The backend and frontend tenant-option catalogs must each contain only:

Global administration

PASS

Backend reports only Global administration.
Frontend proxy reports only Global administration.

BLOCK PROMOTION

Stop if any Tenant context is returned before approval.

0.6 Manual Test Identities

Use separate browser profiles/windows so sessions do not overwrite each other.

Browser	Role	Login	Password
Browser A	Application Administrator	`[email protected]`	`Local-E2E-Administrator-28D!`
Browser B	Exact Support-Tenant Administrator	`[email protected]`	`Local-E2E-Administrator-28D!`
Browser C	Wrong-Tenant Administrator	`[email protected]`	`Local-E2E-Administrator-28D!`
Browser D	Expiry-fixture Tenant Administrator	`[email protected]`	`Local-E2E-Administrator-28D!`

Relevant Tenants:

Purpose	Tenant name	Tenant ID
Normal support lifecycle	`E2E Support Access Lease`	`e2e-support-lease-tenant`
Wrong-Tenant isolation	`E2E Support Access Lease Other Tenant`	`e2e-support-lease-other-tenant`
Expiration verification	`E2E Support Access Lease Expired Tenant`	`e2e-support-lease-expired-tenant`

Record:

Manual suite started:
________________________________________

Test 01 — GLOBAL Application Administrator Isolation and Support Request

Objective

Prove that:

[email protected] begins as a GLOBAL-only Application Administrator;
the Tenant catalog is not an identity catalog;
the Application Administrator has no persistent Tenant identity;
requesting support does not alter that identity;
a PENDING lease does not make the Tenant selectable;
the Application Administrator cannot self-approve;
the wrong Tenant Administrator cannot approve the request.

Test 01.1 — Sign in as the Application Administrator

Identity

Use Browser A.

[email protected]

Password:

Local-E2E-Administrator-28D!

Required context

Current context must be:

Global administration

Steps

Sign in.
Confirm the top bar shows Global administration.
Open the actual top-bar Administration context selector.

Expected result

The selector reports:

1 of 1 contexts

The only option is:

Global administration
GLOBAL
Selected

√ The selector must not contain:

E2E Support Access Lease
E2E Support Access Lease Other Tenant
E2E Support Access Lease Expired Tenant

Record

Number of available contexts before request:
________________________________________

PASS

Exactly one context exists.
That context is Global administration.
No Tenant is available as ordinary identity or support access.

BLOCK PROMOTION

Any Tenant is selectable before an approved Support Access Lease exists.

Test 01.2 — Distinguish the Tenant Inventory from Account Identity

Remain signed in to Browser A as:

[email protected]

Required context:

Global administration

Navigation

Use the application UI:

Administration → Tenants

Steps

Confirm the page heading is Tenant control-plane catalog.
Locate Filter tenants.
Enter:

E2E Support Access Lease

Confirm the Tenant table contains:
- E2E Support Access Lease;
- E2E Support Access Lease Expired Tenant;
- E2E Support Access Lease Other Tenant.
Confirm the blue Identity boundary notice says that this table is the global Tenant inventory and is not the Tenant/context selector.
Click:

Open actual Administration context selector

Expected result

√ The Tenant records remain visible underneath because they are global control-plane Tenant records.

√ The actual Administration context selector must still contain only:

Global administration

PASS

E2E Support Access Lease exists in the Tenant inventory.
E2E Support Access Lease does not exist in the actual Administration context selector.

BLOCK PROMOTION

Merely existing in the Tenant inventory makes a Tenant selectable as an account context.

Test 01.3 — Verify the Persistent Application Administrator Identity Boundary

Remain in Browser A as:

[email protected]

Required context:

Global administration

Navigation

Use the UI:

Administration → Authentication

Steps

Use the Authentication Account filter/search.
Search for:

[email protected]

Open the Authentication Account for [email protected].
Locate its Account identity boundary section.

Record

Person binding: None
________________________________________

Tenant Actor bindings: None
________________________________________

Global Actor bindings: 1
________________________________________

Expected result

Semantically:

√ Person binding          = None — no Person linked
√ Tenant Actor bindings   = None — no Tenant Actors linked
√ Global Actor bindings   = 1

Under Actors:

Confirm the linked Actor is identified as a Global/Application Actor.
Record its Actor ID.
Record its Actor Key.

Application Actor ID: c63263b1-3c64-42a4-b6c6-95585a856cc3
________________________________________

Application Actor Key: e2e-application-admin
________________________________________

√ Expected deterministic Actor Key:

e2e-application-admin

PASS

No Person binding exists.
No Tenant Actor binding exists.
Exactly one Global Actor binding exists.
The Account has no ordinary Tenant identity.

BLOCK PROMOTION

Any persistent Tenant Actor appears.
Any Person binding appears.
Any mixed GLOBAL/TENANT Actor state exists.

Test 01.4 — Open the Support Access Workflow

Remain in Browser A.

Navigation

Use the UI:

Administration → Support access

Steps

Read the introductory text.

Expected result

The page explains that support access does not create:

Tenant Actor;
Person;
Membership;
Collaborator;
Role Grant.

PASS

The UI clearly communicates that support access is temporary authorization of the existing Application Actor.

Test 01.5 — Create a Support Access Request

Remain in Browser A.

Navigation

Open:

Request Tenant support access

Tenant selection

In the Tenant selector/filter, enter:

E2E Support Access Lease

Select exactly:

E2E Support Access Lease
Tenant ID: e2e-support-lease-tenant

Fixed expiration

Choose an expiration at least 30 minutes in the future so the remainder of Tests 01–03 can be completed before natural expiration.

Record:

Requested fixed expiration:
________________________________________

Support reason

Enter exactly:

30L.3 manual promotion — exact-Tenant people.read support verification

Requested permission

Select only:

Read people
people.read

Allowlist check

Before submitting, inspect the permissions offered by the UI.

√ Confirm that control-plane/Tenant-administration permissions such as the following cannot be requested:

authz.read
authz.manage
support_access_leases.approve

BLOCK PROMOTION

Stop if such control-plane permissions are offered as support-lease permissions.

Submit

Click:

Request support access

Test 01.6 — Verify the PENDING Lease

Remain in Browser A.

Navigation

Open:

Lease history

Filter/select:

Tenant: E2E Support Access Lease
Status: Pending

Locate the newly created lease.

Record

Lease ID: 694eea7a-2fda-4a93-9426-eb2e5c52336a
________________________________________

Application Actor: c63263b1-3c64-42a4-b6c6-95585a856cc3
________________________________________

Requested time: 9/13/2026, 2:12:12 PM________________________________________

Fixed expiration: 9/13/2026, 3:10:00 PM
________________________________________

Support reason: 30L.3 manual promotion — exact-Tenant people.read support verification
________________________________________

Expected result

Tenant is E2E Support Access Lease.
Tenant ID is e2e-support-lease-tenant.
Status is PENDING.
Application Actor matches the Actor recorded in Test 01.3.
Fixed expiration matches the requested value.
Support reason matches exactly.
Immutable permission scope contains only people.read.
Approved by is blank or —.
Terminated by is blank or —.
Browser A does not have an Approve support access action for its own request.

BLOCK PROMOTION

Application Administrator can approve its own request.

Test 01.7 — Verify PENDING Does Not Alter the Context Catalog

Remain in Browser A.

Steps

Open the actual top-bar Administration context selector.

Expected result

√ It still contains exactly:

Global administration

√ It must not contain:

E2E Support Access Lease

PASS

A PENDING lease creates no temporary Tenant context.

BLOCK PROMOTION

A PENDING lease makes the Tenant selectable.

Test 01.8 — Verify Wrong-Tenant Isolation

Identity

Open Browser C.

[email protected]

Password:

Local-E2E-Administrator-28D!

Required context

√ Confirm:

E2E Support Access Lease Other Tenant
Tenant ID: e2e-support-lease-other-tenant

Do not change to another Tenant.

Navigation

Use the UI:

Administration → Support access → Lease history

Set:

Status: Pending

Expected result

The lease ID recorded in Test 01.6 for:

e2e-support-lease-tenant

must not be visible.

Browser C must not have an approval action for that lease.

PASS

Wrong-Tenant Administrator cannot see the exact support Tenant's request.
Wrong-Tenant Administrator cannot approve the exact support Tenant's request.

BLOCK PROMOTION

The lease leaks into the wrong Tenant context.
Browser C can approve the lease.

Test 01 — PASS Criteria

Test 01 passes only if:

Application Administrator begins GLOBAL-only.
Tenant inventory is distinct from account contexts.
[email protected] has no Person binding.
[email protected] has no Tenant Actor binding.
[email protected] has exactly one Global Actor binding.
Request targets exactly e2e-support-lease-tenant.
Requested permission is exactly people.read.
Control-plane authority is absent from the support allowlist.
Lease is PENDING.
Tenant remains absent from the context selector while PENDING.
Application Administrator cannot self-approve.
Wrong-Tenant Administrator cannot see or approve the lease.

Test 02 — Exact-Tenant Approval, Temporary Use, Identity Non-Mutation, Termination, and Expiration

Objective

Prove that:

only the exact Tenant Administrator can approve;
approval exposes exactly one temporary support context;
the context is explicitly lease-backed rather than ordinary Tenant identity;
only the requested allowlisted permission works;
approval/use does not mutate persistent identity;
immediate termination removes access;
natural expiration independently removes access.

Test 02A — Approve and Use the Test 01 Lease

Test 02A.1 — Sign In as the Exact Tenant Administrator

Identity

Open Browser B.

[email protected]

Password:

Local-E2E-Administrator-28D!

Required context

Confirm:

E2E Support Access Lease
Tenant ID: e2e-support-lease-tenant

Navigation

Use:

Administration → Support access → Lease history

Set:

Status: Pending

Locate the exact Lease ID recorded in Test 01.

Test 02A.2 — Verify and Approve the Exact Request

Before approving, confirm:

Tenant is E2E Support Access Lease.
Tenant ID is e2e-support-lease-tenant.
Status is PENDING.
Application Actor matches the Test 01 value.
Fixed expiration matches exactly.
Support reason matches exactly.
Immutable permission scope contains only:

people.read

Action

Confirm Browser B sees:

Approve support access

Click it once.

Expected result

A success dialog should confirm approval of the same lease.

Dismiss the dialog.

Record:

Approved by Actor ID:
________________________________________

Expected post-approval state

Status is APPROVED.
Lease ID is unchanged.
Fixed expiration is unchanged.
Immutable permission scope remains exactly people.read.

BLOCK PROMOTION

Approval changes expiration.
Approval changes the permission scope.

Test 02A.3 — Verify Temporary Support Context Appears

Return to Browser A.

Do not sign out or sign back in.

Required starting context

Current context should still be:

Global administration

Steps

Open the actual top-bar Administration context selector.

Expected result

There are now exactly two available contexts:

Global administration

and:

E2E Support Access Lease
Temporary support access

The temporary support option must display lease provenance, including:

Lease: <Test 01 Lease ID>
Expires: <fixed expiration>

Record

Support option Lease ID:
________________________________________

Support option expiration:
________________________________________

Both must match Test 01.

PASS

Tenant appears only after approval.
Tenant is labeled as temporary support access.
Lease ID is displayed.
Expiration is displayed.
No Membership/ordinary Tenant identity presentation is used.

BLOCK PROMOTION

Tenant appears without Lease ID.
Tenant appears without expiration.
Tenant looks like an ordinary Tenant identity.
Another Tenant appears because of this lease.

Test 02A.4 — Select the Temporary Support Context

In Browser A, select:

E2E Support Access Lease — Temporary support access

Expected result

Selector closes.
Current context becomes the leased Tenant.
Authenticated Account remains [email protected].

Navigation authorization

The lease contains only:

people.read

Inspect the application navigation.

Confirm:

People is available.
Expenses is not available as leased authority.
Authorization is not available as leased authority.
Authentication is not available as leased authority.
Tenants is not available as leased authority.
Support access administration is not available from inside the leased Tenant context.

PASS

Navigation reflects the lease's requested permission instead of Application Administrator wildcard authority.

BLOCK PROMOTION

Leased support access exposes unrelated operational or control-plane capabilities.

Test 02A.5 — Exercise the Allowed Permission Through the UI

Remain in Browser A in the temporary support context.

Action

Navigate to:

People

Expected result

People page loads.
No 403 Forbidden occurs.
No 500 Internal Server Error occurs.
Displayed data belongs to E2E Support Access Lease.

Do not create or modify a Person. The lease requested only:

people.read

This action is important because it generates the successful lease-use audit evidence inspected in Test 03.

Record

Approximate time People page was opened:
________________________________________

Test 02A.6 — Verify Exact-Tenant Isolation

In Browser A, open the Administration context selector.

Expected result

Available choices are only:

Global administration
E2E Support Access Lease — Temporary support access

The selector must not include:

E2E Support Access Lease Other Tenant

or:

E2E Support Access Lease Expired Tenant

PASS

One lease exposes only its exact Tenant.

BLOCK PROMOTION

Any other Tenant becomes selectable.

Test 02A.7 — Verify Approval Did Not Mutate Persistent Identity

In Browser A, switch back to:

Global administration

Navigation

Use the UI:

Administration → Authentication

Search for:

[email protected]

Open the Account and inspect:

Account identity boundary

Expected result

Values remain exactly as before approval:

Person binding          = None — no Person linked
Tenant Actor bindings   = None — no Tenant Actors linked
Global Actor bindings   = 1

The same Global Actor ID and Actor Key remain.

PASS

Lease approval/use changed authorization only.
No Person binding appeared.
No Tenant Actor appeared.
Global Actor identity is unchanged.

BLOCK PROMOTION

Lease creation, approval, or use mutates persistent identity.

Test 02A.8 — Terminate the Lease Immediately

Return to Browser B.

Identity:

[email protected]

Required context:

E2E Support Access Lease

Navigation

Use:

Administration → Support access → Lease history

Set:

Status: Approved

Locate the Test 01 Lease ID.

Termination reason

Enter exactly:

30L.3 manual promotion — support verification complete

Click:

Terminate immediately

Expected result

Status becomes:

TERMINATED

Record:

Terminated by Actor ID:
________________________________________

Termination reason displayed:
________________________________________

Confirm:

Termination reason matches exactly.
Terminated by is populated.
Original fixed expiration is unchanged.
Immutable permissions still show only people.read.

BLOCK PROMOTION

Termination changes the immutable expiration.
Termination changes the permission scope.

Test 02A.9 — Verify Termination Removes Temporary Access Immediately

Return to Browser A.

Steps

Open the actual Administration context selector.

Expected result

It now contains only:

Global administration

The terminated support Tenant is absent.

PASS

Termination immediately removes temporary Tenant authority.
Application Administrator Account session remains valid.

BLOCK PROMOTION

Terminated support Tenant remains selectable.

Test 02B — Verify Natural Expiration

This test uses a separate lease so expiration can be verified independently from termination.

Test 02B.1 — Request a Short-Lived Lease

Use Browser A.

Required context:

Global administration

Navigation

Use:

Administration → Support access → Request Tenant support access

Choose:

E2E Support Access Lease Expired Tenant
Tenant ID: e2e-support-lease-expired-tenant

Expiration

Set the fixed expiration approximately 5 minutes in the future.

Allow enough time to approve the lease and confirm it becomes selectable before expiration.

Record:

Expiry-test fixed expiration:
________________________________________

Reason

Enter exactly:

30L.3 manual promotion — approved lease natural expiration verification

Permission

Select only:

people.read

Submit:

Request support access

Open Lease history and record:

Expiry-test Lease ID:
________________________________________

Confirm:

Status: PENDING

Test 02B.2 — Approve the Expiry Lease

Open Browser D.

[email protected]

Password:

Local-E2E-Administrator-28D!

Required context:

E2E Support Access Lease Expired Tenant

Navigation

Use:

Administration → Support access → Lease history

Locate the expiry-test Lease ID.

Click:

Approve support access

Expected result

Status becomes APPROVED.
Fixed expiration remains exactly the requested value.
Permission scope remains people.read.

Test 02B.3 — Confirm Temporary Access Exists Before Expiration

Immediately return to Browser A.

Open the Administration context selector.

Expected result

Before the recorded expiration, the selector includes:

E2E Support Access Lease Expired Tenant
Temporary support access
Lease: <expiry-test Lease ID>
Expires: <recorded expiration>

PASS

Lease is usable before its immutable expiration.

Test 02B.4 — Allow the Fixed Expiration to Pass

Do not terminate the expiry-test lease.

Wait until the recorded expiration has passed.

Allow approximately another 10–20 seconds.

Then reopen or refresh the Administration context selector.

Expected result

The expired Tenant disappears.

Only:

Global administration

remains.

PASS

Temporary context disappears automatically after expiration.

BLOCK PROMOTION

Expired context remains selectable.

Test 02B.5 — Verify History Shows Effective EXPIRED State

Remain in Browser A with:

Global administration

Navigation

Use:

Administration → Support access → Lease history

Filter:

Tenant: E2E Support Access Lease Expired Tenant
Status: Expired

Locate the expiry-test Lease ID.

Expected result

The lease shows an effective state of:

EXPIRED

Confirm:

Original fixed expiration remains unchanged.
Immutable permission scope remains people.read.
Record remains readable for audit.
It does not appear as if a human manually terminated the lease.

BLOCK PROMOTION

Expired Tenant remains usable.
Expiration rewrites the original expiration time.
Historical record disappears.
Lease remains effectively APPROVED after expiration.

Test 02 — PASS Criteria

Test 02 passes only if:

Exact Tenant Administrator approves the exact Tenant request.
Approval preserves fixed expiration.
Approval preserves permission scope.
Application Administrator receives clearly marked temporary support access.
Lease ID is shown in the selector.
Lease expiration is shown in the selector.
Only the exact leased Tenant appears.
people.read works through the UI.
Unrequested/control-plane functionality is not exposed.
Persistent Application Administrator identity remains GLOBAL-only.
Immediate termination removes access.
Natural expiration independently removes access.
Historical lease records remain available.

Test 03 — Human-Readable Audit Attribution

Objective

Verify that a human administrator can inspect the audit history and determine:

Authentication Account;
Actor key;
Actor record;
Actor scope;
exact Tenant;
exact Support Lease;
Session;
Correlation;
authorization source;
applicable Role Grant/source;
request method/path;
authorization decision.

Also prove that natural expiration does not fabricate an Actor-attributed lifecycle event.

Test 03.1 — Review the Terminated Lease's Embedded Audit Trail

Identity

Use Browser B.

[email protected]

Required context:

E2E Support Access Lease

Navigation

Use:

Administration → Support access → Lease history

Filter/find the terminated Test 01 lease.

Click:

Review audit trail

Expected event types

Identify events corresponding to:

support_access_leases.request
support_access_leases.approve
support_access.use
support_access_leases.terminate

The People read performed in Test 02 should produce a support-use event associated with:

people.read

Record

Request event actor:
________________________________________

Approval event actor:
________________________________________

People-read support-use actor:
________________________________________

Termination event actor:
________________________________________

Expected attribution

Request and People-read support use must attribute to the Application Administrator's Application Actor.

Approval and termination must attribute to the exact Tenant Administrator, not the Application Administrator.

Test 03.2 — Open the Full Audit Logs Viewer

Remain in Browser B.

Required Tenant:

E2E Support Access Lease

Navigation

Use:

Administration → Audit logs

Tenant filter

Confirm/select:

e2e-support-lease-tenant

Support Lease filter

Enter the Test 01 Lease ID in:

Support Lease ID

Leave other filters broad enough to display the entire lifecycle.

Click:

Apply Filters

Expected result

Audit rows for the exact lease appear.

For the important rows below, inspect both:

main audit row;
Evidence column/details.

Test 03.3 — Verify Request Attribution

Locate:

support_access_leases.request

Expected decision:

AUTHORIZED

Actor checks

Confirm:

Actor is the Application Administrator Actor Key recorded in Test 01.
Tenant is e2e-support-lease-tenant.
Actor record is populated.
Support Lease equals the exact Test 01 Lease ID.

Evidence checks

Verify the following are populated:

Authentication Account
Actor scope
Session
Correlation
Authorization source
Request

Expected semantics:

Actor scope:
APPLICATION

Authorization source should identify the GLOBAL Application Administrator authority, for example:

GLOBAL_CONTROL_PLANE
APPLICATION_ADMIN

Request should identify the support-access request endpoint, for example:

POST /api/v1/authz/support-access-leases

There must not be an acting Person/Membership attribution for the Application Administrator.

Record

Request Authentication Account ID:
________________________________________

Request Actor key:
________________________________________

Request Actor record:
________________________________________

Request Session:
________________________________________

Request Correlation:
________________________________________

Request Authorization source:
________________________________________

Test 03.4 — Verify Approval Attribution

Locate:

support_access_leases.approve

Expected decision:

AUTHORIZED

Expected identity

The Actor must be the exact Tenant Administrator.

Evidence should indicate semantically:

Actor scope:
TENANT

The following should be populated:

Acting Person
Acting Membership

Authorization source should be the Tenant Administrator Role Grant, for example:

ROLE_GRANT
TENANT_ADMIN

The request path should identify approval of the exact lease.

Record

Approval Authentication Account ID:
________________________________________

Approval Actor key:
________________________________________

Approval Actor record:
________________________________________

Approval Acting Person:
________________________________________

Approval Acting Membership:
________________________________________

Approval Session:
________________________________________

Approval Correlation:
________________________________________

Approval Authorization source:
________________________________________

PASS

Approval is attributed to the exact Tenant Administrator.
Approval is not attributed to [email protected].

Test 03.5 — Verify Successful Support-Use Attribution

Locate the audit row generated when Browser A opened:

People

during Test 02.

Expected relationship:

Operation:
support_access.use

Permission:
people.read

Decision:
AUTHORIZED

Expected attribution

Confirm:

Actor is the Application Administrator Actor.
Actor scope is APPLICATION.
Tenant is e2e-support-lease-tenant.
Support Lease ID equals the Test 01 Lease ID.
Authentication Account matches the Application Administrator Account.
Authorization source is the Support Lease, not a Tenant Role Grant.

Expected authorization source:

SUPPORT_LEASE
<Test 01 Lease ID>

Expected request:

GET /api/v1/people

Record

People-use Authentication Account:
________________________________________

People-use Actor:
________________________________________

People-use Actor record:
________________________________________

People-use Tenant:
________________________________________

People-use Lease:
________________________________________

People-use Session:
________________________________________

People-use Correlation:
________________________________________

People-use Authorization source:
________________________________________

Critical check

Authorization source identifies the same Support Lease ID recorded in Test 01.

BLOCK PROMOTION

The People read is attributed to:

TENANT_ADMIN;
a newly created Tenant Actor;
a Membership;
generic wildcard authority without Support Lease provenance.

Test 03.6 — Verify Termination Attribution

Locate:

support_access_leases.terminate

Expected decision:

AUTHORIZED

Expected identity

Actor must be the exact Tenant Administrator who terminated the lease.

Expected evidence should indicate:

Actor scope:
TENANT

Authorization source should identify:

ROLE_GRANT
TENANT_ADMIN

Support Lease must equal the Test 01 Lease ID.

Record

Termination Authentication Account:
________________________________________

Termination Actor:
________________________________________

Termination Actor record:
________________________________________

Termination Session:
________________________________________

Termination Correlation:
________________________________________

Termination Authorization source:
________________________________________

Cross-check

Approval and termination are attributed to the same exact Tenant Administrator Account.
Approval and termination use Tenant-scoped authorization.
Request and support use remain attributed to the Application Administrator.

Test 03.7 — Verify Human-Readable Identity Separation

Using the recorded values, confirm:

Event	Expected acting identity
Request	Application Administrator / APPLICATION Actor
Approval	Exact Tenant Administrator / TENANT Actor
`people.read` use	Application Administrator / APPLICATION Actor + exact Support Lease
Termination	Exact Tenant Administrator / TENANT Actor

PASS

A reviewer using only the application UI can determine:

who requested the lease;
who approved the lease;
who used the lease;
which exact Tenant was accessed;
which exact Support Lease authorized access;
who terminated the lease;
which Authentication Account participated;
which Actor key participated;
which Actor record participated;
which Session participated;
which Correlation ID participated;
whether authority came from GLOBAL control-plane authority, Tenant Role Grant, or Support Lease.

BLOCK PROMOTION

Audit history cannot distinguish these identities or authorization sources.

Test 03.8 — Verify Expiration Provenance

Use the separate expiry-test lease created in Test 02B.

Identity

Use Browser D.

[email protected]

Required context:

E2E Support Access Lease Expired Tenant

Navigation

Use:

Administration → Support access → Lease history

Locate the expiry-test Lease ID.

Click:

Review audit trail

Expected result

Audit history contains Actor-attributed lifecycle events for actions actually performed, such as:

support_access_leases.request
support_access_leases.approve

There must not be a fabricated Actor-attributed event claiming that a human or synthetic Actor performed expiration.

Specifically, there should not be:

support_access_leases.terminate

unless someone actually performed termination.

This suite deliberately does not terminate the expiry-test lease.

Rationale

Expiration is derived from the immutable expiresAt timestamp.

Time is not an Actor.

ERS must therefore not manufacture a fictitious Actor attribution for natural expiration.

PASS

Request provenance remains.
Approval provenance remains.
Lease history shows effective EXPIRED.
No synthetic Actor-attributed expiration or termination event appears.

BLOCK PROMOTION

Natural expiration is falsely attributed to an administrator or synthetic Actor.

Test 03 — PASS Criteria

Test 03 passes only if:

Request audit identifies the Application Administrator.
Approval identifies the exact Tenant Administrator.
Successful Tenant use identifies the Application Administrator plus exact Support Lease.
Termination identifies the exact Tenant Administrator.
Exact Tenant ID is shown.
Exact Support Lease ID is shown.
Authentication Account is visible.
Actor key is visible.
Actor record is visible.
Actor scope is visible.
Session is visible.
Correlation is visible.
Authorization source is visible.
Support use shows SUPPORT_LEASE authority.
Tenant-admin lifecycle actions show Tenant Administrator Role Grant authority.
Application-admin request shows GLOBAL Application Administrator authority.
Natural expiration creates no fictitious Actor-attributed event.

Final Promotion Checklist

Before promoting Bite 30L.3, confirm all items below.

Automated validation

make local-check passes.
make local-30l3-global-context-check passes before any approved lease exists.

GLOBAL identity boundary

Application Administrator starts GLOBAL-only.
Application Administrator has no Person binding.
Application Administrator has no Tenant Actor binding.
Application Administrator retains exactly one Global Actor binding.
Tenant control-plane inventory is clearly distinct from available account contexts.

Request and approval

PENDING lease does not expose a Tenant context.
Wrong Tenant cannot see or approve the request.
Application Administrator cannot self-approve.
Exact Tenant Administrator can approve.
Approval preserves immutable expiration.
Approval preserves immutable permission scope.

Temporary support access

APPROVED lease exposes only the exact Tenant.
Tenant context is labeled Temporary support access.
Selector shows exact Lease ID.
Selector shows exact expiration.
Only requested permission is usable.
Lease use does not create a Tenant Actor.
Lease use does not create a Person or Membership.
Lease use does not create a Role Grant.
No cross-Tenant leakage occurs.

Termination and expiration

Immediate termination removes access immediately.
Natural expiration removes access automatically.
Termination preserves immutable fixed expiration.
Historical lease records remain available.
Natural expiration does not fabricate an Actor-attributed event.

Audit attribution

Request attribution is complete.
Approval attribution is complete.
Support-use attribution is complete.
Termination attribution is complete.
Authentication Account is visible.
Actor key is visible.
Actor record is visible.
Tenant is visible.
Support Lease is visible.
Session is visible.
Correlation is visible.
Authorization source is visible and correct.
Support use identifies SUPPORT_LEASE as its authority.

Reliability

No unexpected 403 Forbidden occurs for an operation that should be authorized.
No unexpected 500 Internal Server Error occurs.
No unexplained frontend error occurs.
No unexplained backend error occurs.

Final Result

Bite 30L.3 Manual Promotion Result:

[ ] PASS — ready to promote
[ ] FAIL — promotion blocked

Final tested SHA:
________________________________________

Tester:
________________________________________

Date/time:
________________________________________

Notes / defects:
________________________________________
________________________________________
________________________________________

Glossary Impact

Glossary impact: none