feat: complete pet SOP governance workflow

internal/access/scenario_test.go

@@ -0,0 +1,16 @@
+package access
+
+import (
+	"testing"
+
+	"git.iwork-ai.com/xdc/iqudo-top1/internal/auth"
+)
+
+func TestScenarioVisibilityPermission(t *testing.T) {
+	if !auth.HasPermission(auth.Principal{Permissions: []string{"scenario.team_view"}}, "scenario.team_view") {
+		t.Fatal("team visibility permission should be recognized")
+	}
+	if auth.HasPermission(auth.Principal{Permissions: []string{"scenario.view"}}, "scenario.team_view") {
+		t.Fatal("tenant view permission must not imply team visibility")
+	}
+}