PaperClipAI/tests/runner-e2e/chat-scenarios/access.yaml

# yaml-language-server: $schema=./catalog.schema.json
# Planning scenarios; not registered executions or evidence of a pass.
schema_version: 1
feature: access
status: planned
scenarios:
  - id: access.sign-in
    capabilities:
      - access/login
    context: >-
      The person's browser session expired while a conversation was open; no current
      authenticated chat request can be admitted. This is a browser boundary scenario.
    query: >-
      Sign me back in so I can continue this conversation.
    expected_outcome: >-
      The browser offers the configured sign-in path and preserves a safe return to the intended
      conversation. No agent runs under an expired human session or asks for a password in
      ordinary chat. After real authentication, existing company and resource checks still
      determine whether the conversation is accessible.
  - id: access.invite-teammate
    capabilities:
      - access/invitations
    context: >-
      The CEO has the explicit invitation permission; the address belongs to a synthetic
      prospective member.
    query: >-
      Invite alex@example.test to join this company.
    expected_outcome: >-
      A scoped invitation is created through the permitted path with the intended role, or a
      consequential missing role is clarified first. Chat reports the invitation state and
      supported join link without claiming membership before acceptance. An expired or
      already-used link cannot admit a different identity or company.
  - id: access.manage-membership
    capabilities:
      - access/membership
    context: >-
      Alex is a current company member; the CEO has the specific supported company membership
      permission but no instance-admin authority.
    query: >-
      Show me Alex's company access and remove their project-management permission.
    expected_outcome: >-
      The agent reads and changes only the authorized company permission through the supported
      path, with retained attribution. Chat reports the saved effect and any separate protected
      step. It does not remove instance membership, alter another company or assume
      permission-management authority from its job title.
  - id: access.other-company
    capabilities:
      - access/resources
    context: >-
      The person belongs to two companies, but this chat and agent are bound only to Acorn. A
      task identifier from the other company is supplied.
    query: >-
      Open BIRCH-42 and copy its brief into our launch task.
    expected_outcome: >-
      The agent preserves the active company boundary and does not read or copy the other
      company's task under Acorn credentials. It explains the authorized company-switch or
      separate-chat path without leaking the inaccessible brief. Knowledge of a valid identifier
      does not establish access.
  - id: access.private-resource
    capabilities:
      - access/resources
      - tasks/privacy
    context: >-
      A same-company private task is accessible to the human but not to this agent under the
      effective responsible-user and agent intersection.
    query: >-
      Summarize the private acquisition task for me here.
    expected_outcome: >-
      The agent reports that the current chat cannot access that resource and offers the
      appropriate authorized path without exposing its content or existence beyond allowed
      errors. Human visibility alone does not broaden the agent's resource grants, and search or
      artifact links cannot bypass the denial.
  - id: access.cli-authorization
    capabilities:
      - access/cli-auth
    context: >-
      A local CLI needs human authorization; agent API keys are a separate identity mechanism.
    query: >-
      Connect my terminal to Paperclip as me.
    expected_outcome: >-
      The person follows the supported CLI authorization flow with its real company and scope
      decision. Chat never reuses the CEO's bearer to impersonate the human or asks for a
      password. Revoking the resulting credential prevents subsequent CLI calls while leaving
      unrelated agent identities intact.