Access control¶

category:access = category-defining behavior (an ACS must do this at all). capability:access.* = selected when capabilities-coverage.yaml declares the slug applicable. Event/command names are the canonical PQ taxonomy (Pq.Adapters.Framework/pq-events.yaml).

Generated from the matrix

26 scenarios, from Matrix v9. See Adapter Acceptance Tests for how a scenario is written, what the waves mean, and which verdicts a run can record.

Scenario	Purpose	Stimulus	Wave
AAT-ACCESS-CREDENTIAL-01	A synced card is granted access at an authorized door.	human	2
AAT-ACCESS-CREDENTIAL-02	A card with no grant to the door is denied.	human	2
AAT-ACCESS-CREDENTIAL-03	An unknown (unenrolled) card is denied and surfaced as unknown.	human	2
AAT-ACCESS-CREDENTIAL-04	Deleting a credential stops it working at the device.	human	2
AAT-ACCESS-CREDENTIAL-05	A credential update is applied in place, not by duplicate.	pq	1
AAT-ACCESS-CREDENTIAL-06	A synchronized PIN with an even number of digits authenticates at the device.	human	2
AAT-ACCESS-CREDENTIAL-07	A synchronized PIN with an odd number of digits authenticates at the device.	human	2
AAT-ACCESS-CARD-FORMATS-01	A card in a supported format is decoded to the expected PQ number.	human	2
AAT-ACCESS-SYNC-MODE-01	A single credential change takes the sync path the device supports.	pq	1
AAT-ACCESS-SYNC-MODE-02	A sync of one changed credential costs no other credential its access.	human	2
AAT-ACCESS-RESET-RESTORE-01	A reset clears the device tables and re-pushes the whole dataset.	pq	1
AAT-ACCESS-RESET-RESTORE-02	Credentials work again on the device after a reset.	human	2
AAT-ACCESS-DOUBLE-SYNC-01	Running sync twice with unchanged input is a no-op on the PQ side.	pq	1
AAT-ACCESS-DOUBLE-SYNC-02	A repeated sync leaves the device's credential set working.	human	2
AAT-ACCESS-SCHEDULES-01	A schedule the device enforces denies access outside its window.	human	2
AAT-ACCESS-ACCESS-LEVELS-01	An access-level binding grants exactly the access points it covers, and no others.	human	2
AAT-ACCESS-HOLIDAYS-01	A synced holiday calendar changes schedule behavior on the device.	human	2
AAT-ACCESS-ANTIPASSBACK-01	A second entry without an intervening exit is denied on antipassback.	human	2
AAT-ACCESS-DOOR-CONTROL-01	A strike release from PQ opens the door momentarily and is confirmed.	pq	1
AAT-ACCESS-DOOR-CONTROL-02	A permanent-open (unlock) command holds the door open until cancelled.	pq	1
AAT-ACCESS-DOOR-CONTROL-03	Deadbolt lock/unlock is exposed where the protocol has a real lock actuator.	pq	1
AAT-ACCESS-DOOR-CONTROL-04	A forced-open door is reported and its clear is reported.	human	3
AAT-ACCESS-DOOR-CONTROL-05	A held-open (door-open-too-long) condition is reported and clears.	human	3
AAT-ACCESS-READER-MODE-01	Disabling a reader from PQ stops it granting access.	human	2
AAT-ACCESS-OWNERSHIP-01	Synchronization leaves credentials PQ does not own working.	human	2
AAT-ACCESS-CASCADE-01	Deleting a person stops every one of their credentials working, not just the first.	human	2

Credential management + access events (category-defining)¶

AAT-ACCESS-CREDENTIAL-01¶

A synced card is granted access at an authorized door.


Applies when	`category:access`
Stimulus	human · wave 2
Capability	`access.credential_management`
Hardware	A reader and a physical card matching AAT-Card-1.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-CREDENTIAL-05, AAT-ACCESS-DOUBLE-SYNC-01

Given. AAT-Tester-1 holds AAT-Card-1, authorized for the door and synced to the device.

When. The user presents AAT-Card-1 at the door reader.

Then. Access is granted and PQ attributes it to the right person and door.

PQ-visible behavior. pq.event.access.granted on the door/reader Thing naming AAT-Tester-1 and the credential; the strike releases.

Physical acts.

present_credential — the reader of the door the credential is authorized for (credential: the synchronized AAT card)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

AAT-ACCESS-CREDENTIAL-02¶

A card with no grant to the door is denied.


Applies when	`category:access`
Stimulus	human · wave 2
Capability	`access.credential_management`
Hardware	A reader and the card.
Preconditions	`person_without_door_access`
Depends on	AAT-ACCESS-CREDENTIAL-05, AAT-ACCESS-DOUBLE-SYNC-01

Given. AAT-Tester-1 holds AAT-Card-1 synced but with no access level for the door.

When. The user presents AAT-Card-1 at the door reader.

Then. Access is denied for lack of authorization.

PQ-visible behavior. pq.event.access.denied (or .denied.invalid) on the door, attributed to AAT-Tester-1 where the protocol reports identity; the strike does not release.

Physical acts.

present_credential — the reader of the modeled door (credential: the synchronized AAT card, which holds no grant to that door)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.denied;thing={door}
  reject:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

AAT-ACCESS-CREDENTIAL-03¶

An unknown (unenrolled) card is denied and surfaced as unknown.


Applies when	`category:access`
Stimulus	human · wave 2
Capability	`access.credential_management`
Hardware	A reader and a card not enrolled in PQ.
Preconditions	`door_modeled`
Depends on	AAT-CROSS-CUTTING-UNIVERSAL-07

Given. A card the device does not know is used at the reader.

When. The user presents a PQ-unknown card at the door reader.

Then. Access is denied and PQ reports an unknown credential.

PQ-visible behavior. pq.event.access.denied.unknown on the door; where the protocol reports the card number it appears in the payload (card_display) — this is also how the runner captures physical card numbers.

Physical acts.

present_credential — the reader of the modeled door (credential: any card that is not enrolled in PQ)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.denied.unknown;thing={door}
  timeout: 120

AAT-ACCESS-CREDENTIAL-04¶

Deleting a credential stops it working at the device.


Applies when	`capability:access.credential_management`
Stimulus	human · wave 2
Capability	`access.credential_management`
Hardware	A reader and the card.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-CREDENTIAL-05, AAT-ACCESS-CASCADE-01

Given. AAT-Card-1 currently grants access at the door.

When. The credential is removed in PQ and the sync completes, then the card is presented.

Then. The card no longer grants access.

PQ-visible behavior. After the delete syncs (pq.event.access.credential.deleted / sync fact), presenting AAT-Card-1 yields pq.event.access.denied.unknown (or .invalid), not granted.

Physical acts.

present_credential — the reader of the door the credential used to open (credential: the AAT card deleted in PQ)

Steps.

- command: pq.command.access.synchronize
  on: {root}
  expect:
    - type=pq.event.access.synchronization.completed;thing={root}
  timeout: 600
- stimulus: present_credential
  expect:
    - type=pq.event.access.denied;thing={door}
  reject:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

AAT-ACCESS-CREDENTIAL-05¶

A credential update is applied in place, not by duplicate.


Applies when	`capability:access.credential_management`
Stimulus	pq · wave 1
Capability	`access.credential_management`
Preconditions	`person_with_card_and_door_access`

Given. AAT-Card-1 is synced to the device.

When. A property of the credential/person is changed in PQ and re-synced.

Then. The device record is updated, not duplicated.

PQ-visible behavior. The sync reports an in-place update (no second device record for AAT-Tester-1); credential count on the device is unchanged. (Full-only panels reload the set — assert no duplication.)

Steps.

- command: pq.command.access.synchronize
  on: {root}
  expect:
    - type=pq.event.access.synchronization.completed;thing={root}
  timeout: 600

What the steps cannot decide. That the record was updated rather than duplicated is a count in the sync facts, not a record on the timeline; the steps prove the synchronization completed.

AAT-ACCESS-CREDENTIAL-06¶

A synchronized PIN with an even number of digits authenticates at the device.


Applies when	`capability:access.credential_management`
Stimulus	human · wave 2
Capability	`access.credential_management`
Hardware	A device path that authenticates numeric PIN credentials.
Preconditions	`adapter_connected`
Depends on	AAT-ACCESS-CREDENTIAL-05
Since	Matrix v4

Given. The adapter declares numeric PIN credential support and the AAT person holds a PIN with an even digit count, synchronized to the device.

When. The PIN is entered at the device keypad.

Then. It authenticates and is attributed to its enrolled person.

PQ-visible behavior. The entry produces its access or keypad event attributed to the enrolled person — the device accepted the value as stored. Adapters without numeric PIN support record n_a.

Physical acts.

enter_pin — keypad Thing (credential: the AAT even-digit PIN)

Steps.

- stimulus: enter_pin
  expect:
    - type=pq.event.access.granted|pq.event.intrusion;thing={keypad}
  timeout: 120

AAT-ACCESS-CREDENTIAL-07¶

A synchronized PIN with an odd number of digits authenticates at the device.


Applies when	`capability:access.credential_management`
Stimulus	human · wave 2
Capability	`access.credential_management`
Hardware	A device path that authenticates numeric PIN credentials.
Preconditions	`adapter_connected`
Depends on	AAT-ACCESS-CREDENTIAL-05
Since	Matrix v4

Given. The adapter declares numeric PIN credential support and the AAT person holds a PIN with an odd digit count, synchronized to the device.

When. The PIN is entered at the device keypad.

Then. It authenticates and is attributed to its enrolled person.

PQ-visible behavior. The entry produces its access or keypad event attributed to the enrolled person. This is the case that catches encoding defects: protocols that pack digits two per byte need a filler nibble for an odd count, and a wrong filler stores a different value than the one enrolled — invisible until someone actually types it. Adapters whose PIN encoding has no parity sensitivity still run it; those without numeric PIN support record n_a.

Physical acts.

enter_pin — keypad Thing (credential: the AAT odd-digit PIN)

Steps.

- stimulus: enter_pin
  expect:
    - type=pq.event.access.granted|pq.event.intrusion;thing={keypad}
  timeout: 120

Card formats¶

AAT-ACCESS-CARD-FORMATS-01¶

A card in a supported format is decoded to the expected PQ number.


Applies when	`capability:access.card_formats`
Stimulus	human · wave 2
Capability	`access.card_formats`
Hardware	A card of the format under test.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-CREDENTIAL-05

Given. The device accepts the card format AAT-Card-1 is encoded in.

When. The user presents AAT-Card-1.

Then. The number PQ reads matches the enrolled canonical number.

PQ-visible behavior. pq.event.access.granted carries the same credential/number that was enrolled — facility code and bit length decode per the documented format.

Physical acts.

present_credential — the reader of the modeled door (credential: the AAT card encoded in the format under test)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

What the steps cannot decide. The verdict is the equality of the number in the event payload with the enrolled canonical number, which the filter does not read; the steps prove the presentation was granted.

Sync mode¶

AAT-ACCESS-SYNC-MODE-01¶

A single credential change takes the sync path the device supports.


Applies when	`capability:access.sync_mode`
Stimulus	pq · wave 1
Capability	`access.sync_mode`
Preconditions	`person_with_card_and_door_access`
Since	Matrix v5

Given. The device's update capability is known (in-place vs full reload).

When. A single credential changes and a sync runs.

Then. The sync completes on the path the device supports.

PQ-visible behavior. The synchronization completes and its PQ-side facts show the path taken: an in-place device moves only the changed record, a full-only device reloads the whole set. This half proves what PQ sent; that the reload cost no other credential its access is AAT-ACCESS-SYNC-MODE-02.

Steps.

- command: pq.command.access.synchronize
  on: {root}
  expect:
    - type=pq.event.access.synchronization.completed;thing={root}
  timeout: 600

What the steps cannot decide. Which path the sync took is read from its facts, not from a record shape; the steps prove it completed.

AAT-ACCESS-SYNC-MODE-02¶

A sync of one changed credential costs no other credential its access.


Applies when	`capability:access.sync_mode`
Stimulus	human · wave 2
Capability	`access.sync_mode`
Hardware	A reader and a second card synchronized to the same door.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-SYNC-MODE-01
Since	Matrix v5

Given. A second AAT credential holds access to the same door and one credential has just been re-synced.

When. The untouched credential is presented at the reader after that sync.

Then. It still grants — the sync path lost no collateral record.

PQ-visible behavior. pq.event.access.granted for the untouched credential at the door after the sync. Only the device decides whether the record survived the reload, so behavior is the evidence.

Physical acts.

present_credential — the reader of the door both credentials are authorized for (credential: the AAT card that was not changed in the sync)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

Reset & restore¶

AAT-ACCESS-RESET-RESTORE-01¶

A reset clears the device tables and re-pushes the whole dataset.


Applies when	`capability:access.reset_and_restore`
Stimulus	pq · wave 1
Capability	`access.reset_and_restore`
Preconditions	`person_with_card_and_door_access`
Since	Matrix v5

Given. The device holds a synced credential set.

When. pq.command.access.synchronize.reset runs.

Then. The clear is confirmed and a fresh full synchronization follows it.

PQ-visible behavior. The reset command succeeds and a synchronization follows it that completes with the full set re-sent. This half proves what PQ sent; that the panel accepted the reload is AAT-ACCESS-RESET-RESTORE-02. NOTE: wiping every credential off a panel currently raises no audit event — pq.event.access.credential.deleted.all exists in the taxonomy but the reset path does not emit it, so a customer's audit trail shows a synchronization and never the wipe that preceded it. Until that is closed, the scenario asserts the sync, not the wipe.

Steps.

- command: pq.command.access.synchronize.reset
  on: {root}
  expect:
    - kind=commandResult;result=success;thing={root}
    - type=pq.event.access.synchronization.completed;thing={root}
  order: sequence
  timeout: 900

AAT-ACCESS-RESET-RESTORE-02¶

Credentials work again on the device after a reset.


Applies when	`capability:access.reset_and_restore`
Stimulus	human · wave 2
Capability	`access.reset_and_restore`
Hardware	A reader and the card.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-RESET-RESTORE-01
Since	Matrix v5

Given. A reset has cleared the device and the full set has been re-pushed.

When. The synchronized card is presented at the reader after the reset.

Then. It grants — the reloaded dataset is live on the device.

PQ-visible behavior. pq.event.access.granted at the door for the AAT card after the reset completes. Whether the re-pushed record actually landed is the device's answer, given by the door opening.

Physical acts.

present_credential — the reader of the door the credential is authorized for (credential: the AAT card re-pushed by the reset)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

Double-sync safety¶

AAT-ACCESS-DOUBLE-SYNC-01¶

Running sync twice with unchanged input is a no-op on the PQ side.


Applies when	`capability:access.double_sync_safety`
Stimulus	pq · wave 1
Capability	`access.double_sync_safety`
Preconditions	`person_with_card_and_door_access`
Since	Matrix v5

Given. The credential set is synced and unchanged.

When. pq.command.access.synchronize runs a second time with identical input.

Then. The second sync completes with nothing to do — no error, no second round of writes.

PQ-visible behavior. The second synchronization completes without failure and its facts show no records added or re-sent (idempotent Transform). That the device set survived the repeat is AAT-ACCESS-DOUBLE-SYNC-02.

Steps.

- command: pq.command.access.synchronize
  on: {root}
  expect:
    - type=pq.event.access.synchronization.completed;thing={root}
  timeout: 600
- command: pq.command.access.synchronize
  on: {root}
  expect:
    - type=pq.event.access.synchronization.completed;thing={root}
  timeout: 600

What the steps cannot decide. That the second run wrote nothing is a count in its facts; the steps prove both runs completed without failure.

AAT-ACCESS-DOUBLE-SYNC-02¶

A repeated sync leaves the device's credential set working.


Applies when	`capability:access.double_sync_safety`
Stimulus	human · wave 2
Capability	`access.double_sync_safety`
Hardware	A reader and the card.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-DOUBLE-SYNC-01
Since	Matrix v5

Given. The same input has been synchronized twice.

When. The synchronized card is presented at the reader after the second sync.

Then. It grants exactly as before — the repeat neither dropped nor duplicated the record.

PQ-visible behavior. pq.event.access.granted at the door, once, for the AAT card. A duplicated or clobbered device record shows up here as a denial or a doubled event; the device's own tables are not readable back, so behavior carries the verdict.

Physical acts.

present_credential — the reader of the door the credential is authorized for (credential: the AAT card synchronized twice)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

Schedules / time profiles¶

AAT-ACCESS-SCHEDULES-01¶

A schedule the device enforces denies access outside its window.


Applies when	`capability:access.schedules_time_profiles`
Stimulus	human · wave 2
Capability	`access.schedules_time_profiles`
Hardware	A reader and a card; a schedule window that can be tested.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-CREDENTIAL-05

Given. AAT-Card-1's grant is bound to a time schedule and synced.

When. The user presents the card outside the scheduled window.

Then. Access is denied for being out of schedule.

PQ-visible behavior. pq.event.access.denied.schedule at the door when presented outside the window; granted inside it.

Physical acts.

present_credential — the reader of the door the schedule-bound grant covers (credential: the schedule-bound AAT card, presented outside its window)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.denied.schedule;thing={door}
  reject:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

Access levels / groups¶

AAT-ACCESS-ACCESS-LEVELS-01¶

An access-level binding grants exactly the access points it covers, and no others.


Applies when	`capability:access.access_levels_groups`
Stimulus	human · wave 2
Capability	`access.access_levels_groups`
Topology	2× door / partition on distinct addresses
Hardware	Two access points a credential can be exercised at.
Preconditions	`person_with_card_and_door_access`, `two_access_points_modeled`
Depends on	AAT-ACCESS-CREDENTIAL-05, AAT-CROSS-CUTTING-COMMAND-TARGETING-01
Since	Matrix v8

Given. AAT-Tester-1's access level covers access point A but not access point B.

When. The user exercises AAT-Card-1 at A, then at B.

Then. A grants, B denies.

PQ-visible behavior. pq.event.access.granted at A and pq.event.access.denied at B — the level binding flows through person.Devices, not a static mask. The unit of authorization is the access point (access_point: true), not the door: a panel that authorizes users per partition or floor models those as access points too (MODEL-002), and they carry this scenario exactly as doors do. Restricting it to doors would leave an intrusion panel's per-partition authorization — the mechanism most prone to being faked with a static bitmask — untested.

Physical acts.

present_credential — the readers serving the covered access point and the uncovered one, in turn (credential: the synchronized AAT card)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.granted;thing={door}
  timeout: 120
- stimulus: present_credential
  expect:
    - type=pq.event.access.denied;thing={door2}
  reject:
    - type=pq.event.access.granted;thing={door2}
  timeout: 120

Holidays¶

AAT-ACCESS-HOLIDAYS-01¶

A synced holiday calendar changes schedule behavior on the device.


Applies when	`capability:access.holidays`
Stimulus	human · wave 2
Capability	`access.holidays`
Hardware	A reader, the card, and a schedule whose holiday variant differs from the day's normal rule.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-CREDENTIAL-05, AAT-ACCESS-SCHEDULES-01
Since	Matrix v5

Given. A holiday calendar is synced, a schedule references it, and the current day is a holiday it defines.

When. The card bound to that schedule is presented on the holiday.

Then. The decision follows the holiday variant of the schedule.

PQ-visible behavior. The access decision on the holiday follows the holiday rule rather than the weekday rule (granted or denied as the rule says), which is the only proof the calendar reached the device — the panel decides on its own calendar and does not hand it back.

Physical acts.

present_credential — the reader of the door the schedule-bound grant covers, on a holiday the calendar defines (credential: the schedule-bound AAT card)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access;thing={door}
  timeout: 120

What the steps cannot decide. Which decision is correct depends on the holiday rule, so the direction of the outcome — and not its mere arrival — carries the verdict; the step only proves the panel decided.

Antipassback¶

AAT-ACCESS-ANTIPASSBACK-01¶

A second entry without an intervening exit is denied on antipassback.


Applies when	`capability:access.antipassback`
Stimulus	human · wave 2
Capability	`access.antipassback`
Hardware	An APB-configured reader pair.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-CREDENTIAL-05

Given. An APB zone is configured and AAT-Tester-1 has entered.

When. The user presents the card to enter again without exiting.

Then. Access is denied for antipassback violation.

PQ-visible behavior. pq.event.access.denied.antipassback on the second entry; a clear via pq.command.access.antipassback.clear restores normal entry.

Physical acts.

present_credential — the entry reader of the APB zone, twice without an intervening exit (credential: the synchronized AAT card)

Steps.

- stimulus: present_credential
  expect:
    - type=pq.event.access.granted;thing={door}
  timeout: 120
- stimulus: present_credential
  expect:
    - type=pq.event.access.denied.antipassback;thing={door}
  timeout: 120

Door control¶

AAT-ACCESS-DOOR-CONTROL-01¶

A strike release from PQ opens the door momentarily and is confirmed.


Applies when	`category:access`
Stimulus	pq · wave 1
Capability	`access.door_control`
Preconditions	`door_modeled`

Given. A door with a controllable strike is modeled.

When. An operator issues pq.command.access.open on the door.

Then. The strike releases briefly and PQ observes the release.

PQ-visible behavior. pq.event.access.door.unsecured.remote on the door, then relock; command outcome confirmed.

Steps.

- command: pq.command.access.open
  on: {door}
  expect:
    - type=pq.event.access.door.unsecured.remote;thing={door}
  timeout: 30

AAT-ACCESS-DOOR-CONTROL-02¶

A permanent-open (unlock) command holds the door open until cancelled.


Applies when	`capability:access.door_control`
Stimulus	pq · wave 1
Capability	`access.door_control`
Preconditions	`door_modeled`

Given. A door is modeled and secured.

When. An operator issues pq.command.access.open.permanent, then pq.command.access.lock.

Then. The door holds unsecured, then returns to secured on the closing command.

PQ-visible behavior. pq.event.access.door.unsecured.remote persisting after open.permanent, then pq.event.access.door.secured.remote after the closing command.

Steps.

- command: pq.command.access.open.permanent
  on: {door}
  expect:
    - type=pq.event.access.door.unsecured.remote;thing={door}
  timeout: 30
- command: pq.command.access.close
  on: {door}
  expect:
    - type=pq.event.access.door.secured.remote;thing={door}
  timeout: 30

AAT-ACCESS-DOOR-CONTROL-03¶

Deadbolt lock/unlock is exposed where the protocol has a real lock actuator.


Applies when	`capability:access.door_control`
Stimulus	pq · wave 1
Capability	`access.door_control`
Preconditions	`door_modeled`

Given. The door has a lock/deadbolt actuator distinct from the strike.

When. An operator issues pq.command.access.lock then pq.command.access.unlock.

Then. The lock engages and disengages with matching PQ events.

PQ-visible behavior. pq.event.access.door.locked.remote then pq.event.access.door.unlocked.remote. If the device has no real lock actuator (strike only), this is n_a (not_supported_by_protocol), not failed.

Steps.

- command: pq.command.access.lock
  on: {door}
  expect:
    - type=pq.event.access.door.locked.remote;thing={door}
  timeout: 30
- command: pq.command.access.unlock
  on: {door}
  expect:
    - type=pq.event.access.door.unlocked.remote;thing={door}
  timeout: 30

AAT-ACCESS-DOOR-CONTROL-04¶

A forced-open door is reported and its clear is reported.


Applies when	`capability:access.door_control`
Stimulus	human · wave 3
Capability	`access.door_control`
Hardware	A door with a monitored contact.
Preconditions	`door_modeled`
Depends on	AAT-ACCESS-DOOR-CONTROL-01

Given. A door with a position/contact sensor is secured.

When. The user forces the door open without a valid grant, then closes it.

Then. PQ reports the forced condition and its clear.

PQ-visible behavior. pq.event.access.door.forced on the forced open, then pq.event.access.door.forced.cleared on close — both routed.

Physical acts.

open_door — the modeled door with a monitored contact, opened without a grant and closed again

Steps.

- stimulus: open_door
  expect:
    - type=pq.event.access.door.forced;thing={door}
  timeout: 120
- stimulus: open_door
  restore: True
  expect:
    - type=pq.event.access.door.forced.cleared;thing={door}
  timeout: 120

AAT-ACCESS-DOOR-CONTROL-05¶

A held-open (door-open-too-long) condition is reported and clears.


Applies when	`capability:access.door_control`
Stimulus	human · wave 3
Capability	`access.door_control`
Hardware	A door with a monitored contact.
Preconditions	`door_modeled`
Depends on	AAT-ACCESS-DOOR-CONTROL-01

Given. A door with a position sensor and held-open timer.

When. The user holds the door open past the timeout, then closes it.

Then. PQ reports held-open and its clear.

PQ-visible behavior. pq.event.access.door.held after the timeout, then pq.event.access.door.held.cleared on close.

Physical acts.

hold_door — the modeled door with a monitored contact, held past its held-open timeout

Steps.

- stimulus: hold_door
  expect:
    - type=pq.event.access.door.held;thing={door}
  timeout: 180
- stimulus: hold_door
  restore: True
  expect:
    - type=pq.event.access.door.held.cleared;thing={door}
  timeout: 120

Reader mode / enable¶

AAT-ACCESS-READER-MODE-01¶

Disabling a reader from PQ stops it granting access.


Applies when	`capability:access.reader_mode_enable`
Stimulus	human · wave 2
Capability	`access.reader_mode_enable`
Hardware	A reader and the card.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-CROSS-CUTTING-UNIVERSAL-03, AAT-ACCESS-CREDENTIAL-05

Given. AAT-Card-1 normally grants at the reader.

When. An operator issues pq.command.access.disable on the reader, then presents the card.

Then. The disabled reader does not grant; re-enabling restores it.

PQ-visible behavior. After disable, presenting AAT-Card-1 yields no grant (denied/locked or no reaction per protocol); pq.command.access.enable restores pq.event.access.granted.

Physical acts.

present_credential — the disabled reader, and the same reader again after it is re-enabled (credential: the synchronized AAT card)

Steps.

- command: pq.command.access.disable
  on: {reader}
  expect:
    - kind=commandResult;result=success;thing={reader}
  timeout: 30
- stimulus: present_credential
  reject:
    - type=pq.event.access.granted;thing={door}
  timeout: 60
- command: pq.command.access.enable
  on: {reader}
  expect:
    - kind=commandResult;result=success;thing={reader}
  timeout: 30
- stimulus: present_credential
  expect:
    - type=pq.event.access.granted;thing={door}
  timeout: 120

Synchronization ownership and cascade¶

AAT-ACCESS-OWNERSHIP-01¶

Synchronization leaves credentials PQ does not own working.


Applies when	`capability:access.credential_management`
Stimulus	human · wave 2
Capability	`access.credential_management`
Hardware	A credential on the device that PQ did not create and that can be exercised.
Preconditions	`person_with_card_and_door_access`, `foreign_record_on_device`
Depends on	AAT-ACCESS-CREDENTIAL-05
Since	Matrix v4

Given. The device holds a working credential PQ did not create — an installer-entered user whose PIN or card is known and exercisable — alongside the synchronized AAT records.

When. A synchronization runs, including one that removes an AAT credential.

Then. The foreign credential still authenticates afterwards.

PQ-visible behavior. After the sync, using the foreign credential still produces its granted/armed event, while the removed AAT credential no longer does. Wiping a record PQ does not own is irreversible damage on a customer panel, which is why this is verified by using the credential rather than by trusting the sync report — the report only says what PQ intended.

Physical acts.

use_credential — the reader or keypad the foreign credential belongs to (credential: the credential on the device that PQ did not create)

Steps.

- command: pq.command.access.synchronize
  on: {root}
  expect:
    - type=pq.event.access.synchronization.completed;thing={root}
  timeout: 600
- stimulus: use_credential
  expect:
    - type=pq.event.access.granted|pq.event.intrusion.disarmed
  timeout: 180

AAT-ACCESS-CASCADE-01¶

Deleting a person stops every one of their credentials working, not just the first.


Applies when	`capability:access.credential_management`
Stimulus	human · wave 2
Capability	`access.credential_management`
Hardware	A reader and keypad, plus the physical credentials.
Preconditions	`person_with_card_and_door_access`
Depends on	AAT-ACCESS-CREDENTIAL-05
Since	Matrix v4

Given. The AAT person holds more than one credential — card and PIN — all synchronized and all proven working.

When. The person is deleted in PQ and synchronization runs.

Then. Every one of that person's credentials is refused.

PQ-visible behavior. Each credential in turn now yields a denial rather than a grant. A single leftover credential means a departed employee still gets in, so every credential the person held is exercised — testing only one would miss exactly the defect this scenario exists to catch.

Physical acts.

use_credential — the reader or keypad each credential belongs to (credential: every credential the deleted AAT person held, in turn)

Steps.

- command: pq.command.access.synchronize
  on: {root}
  expect:
    - type=pq.event.access.synchronization.completed;thing={root}
  timeout: 600
- stimulus: use_credential
  expect:
    - type=pq.event.access.denied
  reject:
    - type=pq.event.access.granted
  timeout: 180

What the steps cannot decide. Every credential the person held is exercised in turn; the step covers one presentation, so the runner repeats it per credential and the verdict holds only when all of them were refused.