{
  "sample": "Purchase Desk Team",
  "environment": "Production",
  "testedAtUTC": "2026-11-05T15:07:07.449Z",
  "setup": "Disposable local production builds of SpringRoll and Purchase Desk Team. Both people signed in to the same workspace as ordinary app users. The only explicit Production launch policy allowed the Finance group. No release approval was performed.",
  "members": [
    {
      "workspaceRole": "APP_USER",
      "group": "Finance",
      "portalStatus": 307,
      "portalResult": "Redirected to the running app",
      "appSignIn": "Completed as an ordinary non-manager",
      "directAPI": {
        "/api/identity": 200,
        "/api/desk": 200
      }
    },
    {
      "workspaceRole": "APP_USER",
      "group": "Support",
      "portalStatus": 307,
      "portalResult": "Redirected to the app-unavailable page",
      "appSignIn": "Denied before an application session was issued",
      "signInMessage": "You do not have access to this application.",
      "directAPI": {
        "/api/identity": 401,
        "/api/desk": 401
      },
      "apiMessage": "Sign in with your SpringRoll account to continue."
    }
  ],
  "scope": "The Support colleague was signed in to the workspace but had no Purchase Desk Team application session. The 401 responses do not test a previously issued application session or revocation. This test covers the local template and does not establish access controls on another app or hosting provider."
}