# Company, account, vendor

**Test family:** `ORG`

Use this as a business-semantic overlay on the relevant input, CRUD, action, access, money, and time item files.

- **ORG-001** Legal/display/domain names, subsidiaries/parent, addresses, contacts, and status remain distinct.
- **ORG-002** Same name/domain can exist where policy allows; normalized dedupe does not merge unrelated organizations.
- **ORG-003** Parent hierarchy rejects self-parent and cycles; rollups update after move and access changes.
- **ORG-004** Account/vendor activation, suspension, offboarding, and deletion revoke integrations/access while retaining required history.
- **ORG-005** Domain-based discovery or auto-join proves domain control and cannot capture public/shared domains.
- **ORG-006** Vendor permissions/data exports/payments remain scoped to contract and tenant.

## Comprehensive per-item coverage

- **ORG-007** Create with missing, empty, ordinary, minimum, maximum, malformed, unknown, and deprecated field values; report each invalid field without losing valid work.
- **ORG-008** Use names and descriptions containing ASCII emoticons, emoji/ZWJ sequences, kaomoji, accents, mixed scripts, RTL, combining marks, confusables, and boundary lengths.
- **ORG-009** Use inert markup, script, SQL, template, command, path, CSV-formula, header, and log canaries; preserve them as data in every rendered and exported context.
- **ORG-010** Create through UI, API, import, duplication, automation, mobile, admin, and migration; apply one schema, default, authorization, and uniqueness contract.
- **ORG-011** Create exact, case-variant, normalization-equivalent, external-ID, and concurrently submitted duplicates; prevent accidental merge or split identity.
- **ORG-012** Edit from two sessions and through a stale form; detect conflicts, preserve versions, and avoid silent last-write loss.
- **ORG-013** Change parent, owner, status, tenant, and related records; maintain referential integrity, derived values, permissions, and audit atomically.
- **ORG-014** Attempt read and mutation as owner, collaborator, restricted role, removed member, external guest, and another tenant.
- **ORG-015** Change permission or ownership between rendering and commit; reauthorize final reads, writes, downloads, and notifications.
- **ORG-016** Search, filter, sort, group, count, chart, paginate, mention, and deep-link every lifecycle state without hidden records leaking through counts or timing.
- **ORG-017** Retry create/update/delete after timeout and resend the same request; use stable idempotency and return the committed result.
- **ORG-018** Force validation, dependency, storage, index, notification, integration, and audit failures; expose partial state and recovery.
- **ORG-019** Import and export nulls, long values, Unicode, relationships, attachments, unknown fields, old versions, and line-ending/encoding variants.
- **ORG-020** Archive, restore, soft-delete, hard-delete, expire, retain, place on hold, anonymize, and purge according to policy.
- **ORG-021** Reuse identifiers, names, URLs, or external keys after deletion only under an explicit anti-impersonation and reference policy.
- **ORG-022** Verify keyboard, screen reader, zoom/reflow, high contrast, translated labels, RTL, and mobile behavior across create, view, edit, and errors.
- **ORG-023** Measure list, detail, create, update, bulk, search, import, export, and deletion behavior at supported dataset and relationship scale.
- **ORG-024** Verify notifications, webhooks, feeds, analytics, and integrations contain the correct actor, record version, tenant, and permitted fields once.
- **ORG-025** Record actor, authority, source, old/new values, relation changes, time, correlation ID, retries, and outcome without prohibited data.
- **ORG-026** Reconcile record, cache, replica, index, aggregate, attachment, and integration state after delayed or partial processing.

[Back to Records, work management, CRM, and commerce index](../../records-commerce-work.md)
