Add e2e tests

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

GNUmakefile

@@ -71,6 +71,45 @@ coverage-report: test ## Generate HTML coverage report
 test-bench: TEST_FLAGS+=-bench=.
 test-bench: test ## Run benchmark tests
 
+.PHONY: test-e2e
+test-e2e: E2E_CONFIG?=$(CURDIR)/e2e/console/testdata/config.yaml
+test-e2e: CGO_ENABLED=1
+test-e2e: ## Run console e2e tests
+	@echo "Building probod binary..."
+	CGO_ENABLED=0 $(GO) build $(LDFLAGS) $(GCFLAGS) -o bin/probod-e2e ./cmd/probod
+	@echo "Running e2e tests..."
+	PROBO_E2E_BINARY=$(CURDIR)/bin/probod-e2e \
+	PROBO_E2E_CONFIG=$(E2E_CONFIG) \
+	CGO_ENABLED=1 $(GO) test -count=1 -v ./e2e/console/...
+
+.PHONY: test-e2e-coverage
+test-e2e-coverage: E2E_COVER_DIR?=$(CURDIR)/coverage/e2e
+test-e2e-coverage: E2E_CONFIG?=$(CURDIR)/e2e/console/testdata/config.yaml
+test-e2e-coverage: CGO_ENABLED=1
+test-e2e-coverage: ## Build coverage binary and run e2e tests with coverage
+	@echo "Building coverage-instrumented binary..."
+	CGO_ENABLED=0 $(GO) build $(LDFLAGS) $(GCFLAGS) -cover -o bin/probod-coverage ./cmd/probod
+	@$(RM) -rf $(E2E_COVER_DIR)
+	@$(MKDIR) -p $(E2E_COVER_DIR)
+	@echo "Running e2e tests with coverage..."
+	PROBO_E2E_BINARY=$(CURDIR)/bin/probod-coverage \
+	PROBO_E2E_COVERDIR=$(E2E_COVER_DIR) \
+	PROBO_E2E_CONFIG=$(E2E_CONFIG) \
+	CGO_ENABLED=1 $(GO) test -count=1 -v ./e2e/console/...
+	@echo "Generating coverage report..."
+	$(GO) tool covdata textfmt -i=$(E2E_COVER_DIR) -o=coverage-e2e.out
+	$(GO) tool cover -html=coverage-e2e.out -o=coverage-e2e.html
+	@echo "E2E coverage report generated: coverage-e2e.html"
+
+.PHONY: coverage-combined
+coverage-combined: E2E_COVER_DIR?=./coverage/e2e
+coverage-combined: coverage-report test-e2e-coverage ## Generate combined coverage report (unit + e2e)
+	@echo "Merging coverage reports..."
+	@cat coverage.out > coverage-combined.out
+	@tail -n +2 coverage-e2e.out >> coverage-combined.out
+	$(GO) tool cover -html=coverage-combined.out -o=coverage-combined.html
+	@echo "Combined coverage report generated: coverage-combined.html"
+
 .PHONY: build
 build: @probo/emails @probo/console @probo/trust bin/probod
 
@@ -172,7 +211,8 @@ clean: ## Clean the project (node_modules and build artifacts)
 	$(RM) -rf apps/{console,trust}/{dist,node_modules}
 	$(RM) -rf packages/emails/{dist,node_modules}
 	$(RM) -rf sbom-docker.json sbom.json
-	$(RM) -rf coverage.out coverage.html
+	$(RM) -rf coverage.out coverage.html coverage-e2e.out coverage-e2e.html coverage-combined.out coverage-combined.html
+	$(RM) -rf coverage/
 
 .PHONY: stack-up
 stack-up: compose/pebble/certs/rootCA.pem ## Start the docker stack as a deamon

e2e/console/asset_test.go

@@ -0,0 +1,378 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestAsset_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner").
+		Create()
+
+	const query = `
+		mutation($input: CreateAssetInput!) {
+			createAsset(input: $input) {
+				assetEdge {
+					node {
+						id
+						name
+						amount
+						assetType
+						dataTypesStored
+						owner {
+							id
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateAsset struct {
+			AssetEdge struct {
+				Node struct {
+					ID              string `json:"id"`
+					Name            string `json:"name"`
+					Amount          int    `json:"amount"`
+					AssetType       string `json:"assetType"`
+					DataTypesStored string `json:"dataTypesStored"`
+					Owner           struct {
+						ID string `json:"id"`
+					} `json:"owner"`
+				} `json:"node"`
+			} `json:"assetEdge"`
+		} `json:"createAsset"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId":  owner.GetOrganizationID().String(),
+			"name":            "Production Database Server",
+			"amount":          5,
+			"ownerId":         peopleID,
+			"assetType":       "VIRTUAL",
+			"dataTypesStored": "Customer PII, Financial Records",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	asset := result.CreateAsset.AssetEdge.Node
+	assert.NotEmpty(t, asset.ID)
+	assert.Equal(t, "Production Database Server", asset.Name)
+	assert.Equal(t, 5, asset.Amount)
+	assert.Equal(t, "VIRTUAL", asset.AssetType)
+	assert.Equal(t, "Customer PII, Financial Records", asset.DataTypesStored)
+	assert.Equal(t, peopleID, asset.Owner.ID)
+}
+
+func TestAsset_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner for Update").
+		Create()
+
+	const createQuery = `
+		mutation($input: CreateAssetInput!) {
+			createAsset(input: $input) {
+				assetEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateAsset struct {
+			AssetEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"assetEdge"`
+		} `json:"createAsset"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId":  owner.GetOrganizationID().String(),
+			"name":            "Test Asset",
+			"amount":          10,
+			"ownerId":         peopleID,
+			"assetType":       "VIRTUAL",
+			"dataTypesStored": "Test data",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	assetID := createResult.CreateAsset.AssetEdge.Node.ID
+
+	const query = `
+		mutation($input: UpdateAssetInput!) {
+			updateAsset(input: $input) {
+				asset {
+					id
+					name
+					amount
+					dataTypesStored
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateAsset struct {
+			Asset struct {
+				ID              string `json:"id"`
+				Name            string `json:"name"`
+				Amount          int    `json:"amount"`
+				DataTypesStored string `json:"dataTypesStored"`
+			} `json:"asset"`
+		} `json:"updateAsset"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":              assetID,
+			"name":            "Updated Asset Name",
+			"amount":          20,
+			"dataTypesStored": "Updated data types",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, assetID, result.UpdateAsset.Asset.ID)
+	assert.Equal(t, "Updated Asset Name", result.UpdateAsset.Asset.Name)
+	assert.Equal(t, 20, result.UpdateAsset.Asset.Amount)
+}
+
+func TestAsset_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner for Delete").
+		Create()
+
+	const createQuery = `
+		mutation($input: CreateAssetInput!) {
+			createAsset(input: $input) {
+				assetEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateAsset struct {
+			AssetEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"assetEdge"`
+		} `json:"createAsset"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId":  owner.GetOrganizationID().String(),
+			"name":            "Asset to delete",
+			"amount":          1,
+			"ownerId":         peopleID,
+			"assetType":       "VIRTUAL",
+			"dataTypesStored": "None",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	assetID := createResult.CreateAsset.AssetEdge.Node.ID
+
+	const query = `
+		mutation($input: DeleteAssetInput!) {
+			deleteAsset(input: $input) {
+				deletedAssetId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteAsset struct {
+			DeletedAssetID string `json:"deletedAssetId"`
+		} `json:"deleteAsset"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"assetId": assetID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, assetID, result.DeleteAsset.DeletedAssetID)
+}
+
+func TestAsset_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner for List").
+		Create()
+
+	// Create multiple assets
+	for i := 0; i < 3; i++ {
+		const query = `
+			mutation($input: CreateAssetInput!) {
+				createAsset(input: $input) {
+					assetEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateAsset struct {
+				AssetEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"assetEdge"`
+			} `json:"createAsset"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId":  owner.GetOrganizationID().String(),
+				"name":            fmt.Sprintf("Asset %c", 'A'+i),
+				"amount":          i + 1,
+				"ownerId":         peopleID,
+				"assetType":       "VIRTUAL",
+				"dataTypesStored": "Test data",
+			},
+		}, &result)
+		require.NoError(t, err)
+	}
+
+	const query = `
+		query($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					assets(first: 10) {
+						edges {
+							node {
+								id
+								name
+								amount
+								assetType
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Assets struct {
+				Edges []struct {
+					Node struct {
+						ID        string `json:"id"`
+						Name      string `json:"name"`
+						Amount    int    `json:"amount"`
+						AssetType string `json:"assetType"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"assets"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Assets.TotalCount, 3)
+}
+
+func TestAsset_Types(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Asset Owner for Types").
+		Create()
+
+	assetTypes := []string{"PHYSICAL", "VIRTUAL"}
+
+	for _, assetType := range assetTypes {
+		t.Run(assetType, func(t *testing.T) {
+			const query = `
+				mutation($input: CreateAssetInput!) {
+					createAsset(input: $input) {
+						assetEdge {
+							node {
+								id
+								assetType
+							}
+						}
+					}
+				}
+			`
+
+			var result struct {
+				CreateAsset struct {
+					AssetEdge struct {
+						Node struct {
+							ID        string `json:"id"`
+							AssetType string `json:"assetType"`
+						} `json:"node"`
+					} `json:"assetEdge"`
+				} `json:"createAsset"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"organizationId":  owner.GetOrganizationID().String(),
+					"name":            "Asset " + assetType,
+					"amount":          1,
+					"ownerId":         peopleID,
+					"assetType":       assetType,
+					"dataTypesStored": "Test data",
+				},
+			}, &result)
+			require.NoError(t, err)
+			assert.Equal(t, assetType, result.CreateAsset.AssetEdge.Node.AssetType)
+		})
+	}
+}

e2e/console/continual_improvement_test.go

@@ -0,0 +1,394 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestContinualImprovement_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	query := `
+		mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+			createContinualImprovement(input: $input) {
+				continualImprovementEdge {
+					node {
+						id
+						referenceId
+						description
+						source
+						status
+						priority
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateContinualImprovement struct {
+			ContinualImprovementEdge struct {
+				Node struct {
+					ID          string `json:"id"`
+					ReferenceID string `json:"referenceId"`
+					Description string `json:"description"`
+					Source      string `json:"source"`
+					Status      string `json:"status"`
+					Priority    string `json:"priority"`
+				} `json:"node"`
+			} `json:"continualImprovementEdge"`
+		} `json:"createContinualImprovement"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("CI-%d", time.Now().UnixNano()),
+			"description":    "Improve security training program",
+			"source":         "Internal Audit",
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+			"priority":       "HIGH",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	ci := result.CreateContinualImprovement.ContinualImprovementEdge.Node
+	assert.NotEmpty(t, ci.ID)
+	assert.Equal(t, "Improve security training program", ci.Description)
+	assert.Equal(t, "Internal Audit", ci.Source)
+	assert.Equal(t, "OPEN", ci.Status)
+	assert.Equal(t, "HIGH", ci.Priority)
+}
+
+func TestContinualImprovement_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	createQuery := `
+		mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+			createContinualImprovement(input: $input) {
+				continualImprovementEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateContinualImprovement struct {
+			ContinualImprovementEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"continualImprovementEdge"`
+		} `json:"createContinualImprovement"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("CI-UPDATE-%d", time.Now().UnixNano()),
+			"description":    "Original description",
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+			"priority":       "LOW",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	ciID := createResult.CreateContinualImprovement.ContinualImprovementEdge.Node.ID
+
+	query := `
+		mutation UpdateContinualImprovement($input: UpdateContinualImprovementInput!) {
+			updateContinualImprovement(input: $input) {
+				continualImprovement {
+					id
+					description
+					status
+					priority
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateContinualImprovement struct {
+			ContinualImprovement struct {
+				ID          string `json:"id"`
+				Description string `json:"description"`
+				Status      string `json:"status"`
+				Priority    string `json:"priority"`
+			} `json:"continualImprovement"`
+		} `json:"updateContinualImprovement"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":          ciID,
+			"description": "Updated description",
+			"status":      "IN_PROGRESS",
+			"priority":    "HIGH",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, ciID, result.UpdateContinualImprovement.ContinualImprovement.ID)
+	assert.Equal(t, "Updated description", result.UpdateContinualImprovement.ContinualImprovement.Description)
+	assert.Equal(t, "IN_PROGRESS", result.UpdateContinualImprovement.ContinualImprovement.Status)
+	assert.Equal(t, "HIGH", result.UpdateContinualImprovement.ContinualImprovement.Priority)
+}
+
+func TestContinualImprovement_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	createQuery := `
+		mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+			createContinualImprovement(input: $input) {
+				continualImprovementEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateContinualImprovement struct {
+			ContinualImprovementEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"continualImprovementEdge"`
+		} `json:"createContinualImprovement"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("CI-DELETE-%d", time.Now().UnixNano()),
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+			"priority":       "LOW",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	ciID := createResult.CreateContinualImprovement.ContinualImprovementEdge.Node.ID
+
+	query := `
+		mutation DeleteContinualImprovement($input: DeleteContinualImprovementInput!) {
+			deleteContinualImprovement(input: $input) {
+				deletedContinualImprovementId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteContinualImprovement struct {
+			DeletedContinualImprovementID string `json:"deletedContinualImprovementId"`
+		} `json:"deleteContinualImprovement"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"continualImprovementId": ciID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, ciID, result.DeleteContinualImprovement.DeletedContinualImprovementID)
+}
+
+func TestContinualImprovement_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	createQuery := `
+		mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+			createContinualImprovement(input: $input) {
+				continualImprovementEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	for i := 0; i < 3; i++ {
+		_, err := owner.Do(createQuery, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"referenceId":    fmt.Sprintf("CI-LIST-%d-%d", i, time.Now().UnixNano()),
+				"description":    fmt.Sprintf("Improvement %d", i),
+				"ownerId":        peopleID,
+				"status":         "OPEN",
+				"priority":       "MEDIUM",
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetContinualImprovements($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					continualImprovements(first: 10) {
+						edges {
+							node {
+								id
+								referenceId
+								status
+								priority
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ContinualImprovements struct {
+				Edges []struct {
+					Node struct {
+						ID          string `json:"id"`
+						ReferenceID string `json:"referenceId"`
+						Status      string `json:"status"`
+						Priority    string `json:"priority"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"continualImprovements"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.ContinualImprovements.TotalCount, 3)
+}
+
+func TestContinualImprovement_StatusAndPriorityValues(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("CI Owner").Create()
+
+	t.Run("status values", func(t *testing.T) {
+		statuses := []string{"OPEN", "IN_PROGRESS", "CLOSED"}
+
+		for _, status := range statuses {
+			t.Run(status, func(t *testing.T) {
+				query := `
+					mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+						createContinualImprovement(input: $input) {
+							continualImprovementEdge {
+								node {
+									id
+									status
+								}
+							}
+						}
+					}
+				`
+
+				var result struct {
+					CreateContinualImprovement struct {
+						ContinualImprovementEdge struct {
+							Node struct {
+								ID     string `json:"id"`
+								Status string `json:"status"`
+							} `json:"node"`
+						} `json:"continualImprovementEdge"`
+					} `json:"createContinualImprovement"`
+				}
+
+				err := owner.Execute(query, map[string]any{
+					"input": map[string]any{
+						"organizationId": owner.GetOrganizationID().String(),
+						"referenceId":    fmt.Sprintf("CI-STATUS-%s-%d", status, time.Now().UnixNano()),
+						"ownerId":        peopleID,
+						"status":         status,
+						"priority":       "LOW",
+					},
+				}, &result)
+				require.NoError(t, err)
+				assert.Equal(t, status, result.CreateContinualImprovement.ContinualImprovementEdge.Node.Status)
+			})
+		}
+	})
+
+	t.Run("priority values", func(t *testing.T) {
+		priorities := []string{"LOW", "MEDIUM", "HIGH"}
+
+		for _, priority := range priorities {
+			t.Run(priority, func(t *testing.T) {
+				query := `
+					mutation CreateContinualImprovement($input: CreateContinualImprovementInput!) {
+						createContinualImprovement(input: $input) {
+							continualImprovementEdge {
+								node {
+									id
+									priority
+								}
+							}
+						}
+					}
+				`
+
+				var result struct {
+					CreateContinualImprovement struct {
+						ContinualImprovementEdge struct {
+							Node struct {
+								ID       string `json:"id"`
+								Priority string `json:"priority"`
+							} `json:"node"`
+						} `json:"continualImprovementEdge"`
+					} `json:"createContinualImprovement"`
+				}
+
+				err := owner.Execute(query, map[string]any{
+					"input": map[string]any{
+						"organizationId": owner.GetOrganizationID().String(),
+						"referenceId":    fmt.Sprintf("CI-PRIORITY-%s-%d", priority, time.Now().UnixNano()),
+						"ownerId":        peopleID,
+						"status":         "OPEN",
+						"priority":       priority,
+					},
+				}, &result)
+				require.NoError(t, err)
+				assert.Equal(t, priority, result.CreateContinualImprovement.ContinualImprovementEdge.Node.Priority)
+			})
+		}
+	})
+}

e2e/console/control_test.go

@@ -0,0 +1,958 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestControl_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	frameworkID := factory.CreateFramework(owner, factory.Attrs{"name": "Framework for Control Tests"})
+
+	t.Run("with full details", func(t *testing.T) {
+		query := `
+			mutation CreateControl($input: CreateControlInput!) {
+				createControl(input: $input) {
+					controlEdge {
+						node {
+							id
+							name
+							sectionTitle
+							status
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateControl struct {
+				ControlEdge struct {
+					Node struct {
+						ID           string `json:"id"`
+						Name         string `json:"name"`
+						SectionTitle string `json:"sectionTitle"`
+						Status       string `json:"status"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+			} `json:"createControl"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"frameworkId":  frameworkID,
+				"sectionTitle": "A.5",
+				"name":         "Information Security Policies",
+				"description":  "Policies for information security",
+				"status":       "INCLUDED",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		control := result.CreateControl.ControlEdge.Node
+		assert.NotEmpty(t, control.ID)
+		assert.Equal(t, "Information Security Policies", control.Name)
+		assert.Equal(t, "A.5", control.SectionTitle)
+		assert.Equal(t, "INCLUDED", control.Status)
+	})
+
+	t.Run("with excluded status and justification", func(t *testing.T) {
+		query := `
+			mutation CreateControl($input: CreateControlInput!) {
+				createControl(input: $input) {
+					controlEdge {
+						node {
+							id
+							status
+							exclusionJustification
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateControl struct {
+				ControlEdge struct {
+					Node struct {
+						ID                     string  `json:"id"`
+						Status                 string  `json:"status"`
+						ExclusionJustification *string `json:"exclusionJustification"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+			} `json:"createControl"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"frameworkId":            frameworkID,
+				"sectionTitle":           "A.10",
+				"name":                   "Cryptography",
+				"description":            "Cryptography controls",
+				"status":                 "EXCLUDED",
+				"exclusionJustification": "Not applicable - no cryptographic data processing",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		control := result.CreateControl.ControlEdge.Node
+		assert.Equal(t, "EXCLUDED", control.Status)
+		assert.Equal(t, "Not applicable - no cryptographic data processing", *control.ExclusionJustification)
+	})
+}
+
+func TestControl_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	frameworkID := factory.CreateFramework(owner, factory.Attrs{"name": "Framework for Control Update"})
+	controlID := factory.CreateControl(owner, frameworkID, factory.Attrs{
+		"name":        "Control to Update",
+		"description": "Original description",
+	})
+
+	t.Run("updates name and description", func(t *testing.T) {
+		query := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						name
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateControl struct {
+				Control struct {
+					ID   string `json:"id"`
+					Name string `json:"name"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":          controlID,
+				"name":        "Updated Control Name",
+				"description": "Updated description",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, controlID, result.UpdateControl.Control.ID)
+		assert.Equal(t, "Updated Control Name", result.UpdateControl.Control.Name)
+	})
+
+	t.Run("changes status from INCLUDED to EXCLUDED", func(t *testing.T) {
+		statusTestControlID := factory.CreateControl(owner, frameworkID, factory.Attrs{
+			"name":   "Status Change Control",
+			"status": "INCLUDED",
+		})
+
+		query := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						status
+						exclusionJustification
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateControl struct {
+				Control struct {
+					ID                     string  `json:"id"`
+					Status                 string  `json:"status"`
+					ExclusionJustification *string `json:"exclusionJustification"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":                     statusTestControlID,
+				"status":                 "EXCLUDED",
+				"exclusionJustification": "No physical assets in scope",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, "EXCLUDED", result.UpdateControl.Control.Status)
+		assert.Equal(t, "No physical assets in scope", *result.UpdateControl.Control.ExclusionJustification)
+	})
+}
+
+func TestControl_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	frameworkID := factory.CreateFramework(owner, factory.Attrs{
+		"name": "Framework for Delete",
+	})
+	controlID := factory.CreateControl(owner, frameworkID, factory.Attrs{
+		"name": "Control to Delete",
+	})
+
+	query := `
+		mutation DeleteControl($input: DeleteControlInput!) {
+			deleteControl(input: $input) {
+				deletedControlId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteControl struct {
+			DeletedControlID string `json:"deletedControlId"`
+		} `json:"deleteControl"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"controlId": controlID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, controlID, result.DeleteControl.DeletedControlID)
+}
+
+func TestControl_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	frameworkID := factory.CreateFramework(owner, factory.Attrs{"name": "Framework for List Test"})
+
+	// Create multiple controls
+	controlNames := []string{"Control A", "Control B", "Control C"}
+	for i, name := range controlNames {
+		factory.CreateControl(owner, frameworkID, factory.Attrs{
+			"name":         name,
+			"sectionTitle": fmt.Sprintf("A.%d", 5+i),
+		})
+	}
+
+	query := `
+		query GetFrameworkControls($id: ID!) {
+			node(id: $id) {
+				... on Framework {
+					id
+					name
+					controls(first: 10) {
+						edges {
+							node {
+								id
+								name
+								sectionTitle
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ID       string `json:"id"`
+			Name     string `json:"name"`
+			Controls struct {
+				Edges []struct {
+					Node struct {
+						ID           string `json:"id"`
+						Name         string `json:"name"`
+						SectionTitle string `json:"sectionTitle"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"controls"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{"id": frameworkID}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(result.Node.Controls.Edges), 3)
+}
+
+func TestControl_RequiredFields(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework first
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var frameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Control Required Fields Test %d", time.Now().UnixNano()),
+		},
+	}, &frameworkResult)
+	require.NoError(t, err)
+	frameworkID := frameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	createControlQuery := `
+		mutation CreateControl($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	tests := []struct {
+		name      string
+		variables map[string]any
+		wantError bool
+	}{
+		{
+			name: "Missing frameworkId should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"status":       "INCLUDED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing name should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"status":       "INCLUDED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing sectionTitle should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId": frameworkID,
+					"name":        "Test Control",
+					"description": "Test",
+					"status":      "INCLUDED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing status should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing description should fail (required field)",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"sectionTitle": "Section 1",
+					"status":       "INCLUDED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Invalid status enum should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"status":       "INVALID_STATUS",
+				},
+			},
+			wantError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := owner.Do(createControlQuery, tt.variables)
+
+			if tt.wantError {
+				require.Error(t, err, "Expected validation error")
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestControl_OmittableDescription(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create framework
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var frameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Control Omittable Test %d", time.Now().UnixNano()),
+		},
+	}, &frameworkResult)
+	require.NoError(t, err)
+	frameworkID := frameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	// Create control with description
+	createControlQuery := `
+		mutation CreateControl($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+						description
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID          string `json:"id"`
+					Description string `json:"description"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+
+	err = owner.Execute(createControlQuery, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Omittable Test Control",
+			"description":  "Initial description",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	controlID := createResult.CreateControl.ControlEdge.Node.ID
+
+	t.Run("Update with null description should clear it", func(t *testing.T) {
+		updateControlQuery := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						description
+					}
+				}
+			}
+		`
+
+		var updateResult struct {
+			UpdateControl struct {
+				Control struct {
+					ID          string  `json:"id"`
+					Description *string `json:"description"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err := owner.Execute(updateControlQuery, map[string]any{
+			"input": map[string]any{
+				"id":          controlID,
+				"description": nil,
+			},
+		}, &updateResult)
+		require.NoError(t, err)
+		assert.Nil(t, updateResult.UpdateControl.Control.Description)
+	})
+
+	t.Run("Update without description should not change it", func(t *testing.T) {
+		// Set description first
+		setDescQuery := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+					}
+				}
+			}
+		`
+
+		var setDescResult struct {
+			UpdateControl struct {
+				Control struct {
+					ID string `json:"id"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err := owner.Execute(setDescQuery, map[string]any{
+			"input": map[string]any{
+				"id":          controlID,
+				"description": "Should persist",
+			},
+		}, &setDescResult)
+		require.NoError(t, err)
+
+		// Update only name
+		updateNameQuery := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						name
+						description
+					}
+				}
+			}
+		`
+
+		var updateResult struct {
+			UpdateControl struct {
+				Control struct {
+					ID          string `json:"id"`
+					Name        string `json:"name"`
+					Description string `json:"description"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err = owner.Execute(updateNameQuery, map[string]any{
+			"input": map[string]any{
+				"id":   controlID,
+				"name": "Updated Name",
+			},
+		}, &updateResult)
+		require.NoError(t, err)
+		assert.Equal(t, "Should persist", updateResult.UpdateControl.Control.Description)
+	})
+}
+
+func TestControl_SubResolvers(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create framework
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var frameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Control SubResolver Test %d", time.Now().UnixNano()),
+		},
+	}, &frameworkResult)
+	require.NoError(t, err)
+	frameworkID := frameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	// Create control
+	createControlQuery := `
+		mutation CreateControl($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var controlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+
+	err = owner.Execute(createControlQuery, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "SubResolver Test Control",
+			"description":  "Test description",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &controlResult)
+	require.NoError(t, err)
+	controlID := controlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create a measure and link it
+	createMeasureQuery := `
+		mutation CreateMeasure($input: CreateMeasureInput!) {
+			createMeasure(input: $input) {
+				measureEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var measureResult struct {
+		CreateMeasure struct {
+			MeasureEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"measureEdge"`
+		} `json:"createMeasure"`
+	}
+
+	err = owner.Execute(createMeasureQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Test Measure for Control",
+			"category":       "POLICY",
+		},
+	}, &measureResult)
+	require.NoError(t, err)
+	measureID := measureResult.CreateMeasure.MeasureEdge.Node.ID
+
+	// Create mapping
+	createMappingQuery := `
+		mutation CreateControlMeasureMapping($input: CreateControlMeasureMappingInput!) {
+			createControlMeasureMapping(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var mappingResult struct {
+		CreateControlMeasureMapping struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControlMeasureMapping"`
+	}
+
+	err = owner.Execute(createMappingQuery, map[string]any{
+		"input": map[string]any{
+			"controlId": controlID,
+			"measureId": measureID,
+		},
+	}, &mappingResult)
+	require.NoError(t, err)
+
+	t.Run("Control framework sub-resolver", func(t *testing.T) {
+		query := `
+			query GetControlFramework($id: ID!) {
+				node(id: $id) {
+					... on Control {
+						id
+						framework {
+							id
+							name
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID        string `json:"id"`
+				Framework struct {
+					ID   string `json:"id"`
+					Name string `json:"name"`
+				} `json:"framework"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"id": controlID,
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, frameworkID, result.Node.Framework.ID)
+	})
+
+	t.Run("Control measures sub-resolver", func(t *testing.T) {
+		query := `
+			query GetControlMeasures($id: ID!) {
+				node(id: $id) {
+					... on Control {
+						id
+						measures(first: 10) {
+							edges {
+								node {
+									id
+									name
+								}
+							}
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID       string `json:"id"`
+				Measures struct {
+					Edges []struct {
+						Node struct {
+							ID   string `json:"id"`
+							Name string `json:"name"`
+						} `json:"node"`
+					} `json:"edges"`
+				} `json:"measures"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"id": controlID,
+		}, &result)
+		require.NoError(t, err)
+		assert.GreaterOrEqual(t, len(result.Node.Measures.Edges), 1)
+	})
+}
+
+func TestControl_ExclusionJustification(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create framework
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var frameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Exclusion Test %d", time.Now().UnixNano()),
+		},
+	}, &frameworkResult)
+	require.NoError(t, err)
+	frameworkID := frameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	t.Run("EXCLUDED status should have exclusionJustification", func(t *testing.T) {
+		createControlQuery := `
+			mutation CreateControl($input: CreateControlInput!) {
+				createControl(input: $input) {
+					controlEdge {
+						node {
+							id
+							status
+							exclusionJustification
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateControl struct {
+				ControlEdge struct {
+					Node struct {
+						ID                     string `json:"id"`
+						Status                 string `json:"status"`
+						ExclusionJustification string `json:"exclusionJustification"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+			} `json:"createControl"`
+		}
+
+		err := owner.Execute(createControlQuery, map[string]any{
+			"input": map[string]any{
+				"frameworkId":            frameworkID,
+				"name":                   "Excluded Control",
+				"description":            "Test",
+				"sectionTitle":           "Section 1",
+				"status":                 "EXCLUDED",
+				"exclusionJustification": "Not applicable to our business",
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, "EXCLUDED", result.CreateControl.ControlEdge.Node.Status)
+		assert.Equal(t, "Not applicable to our business", result.CreateControl.ControlEdge.Node.ExclusionJustification)
+	})
+
+	t.Run("Change status from INCLUDED to EXCLUDED", func(t *testing.T) {
+		// Create included control first
+		createControlQuery := `
+			mutation CreateControl($input: CreateControlInput!) {
+				createControl(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var createResult struct {
+			CreateControl struct {
+				ControlEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+			} `json:"createControl"`
+		}
+
+		err := owner.Execute(createControlQuery, map[string]any{
+			"input": map[string]any{
+				"frameworkId":  frameworkID,
+				"name":         "To Be Excluded Control",
+				"description":  "Test",
+				"sectionTitle": "Section 2",
+				"status":       "INCLUDED",
+			},
+		}, &createResult)
+		require.NoError(t, err)
+
+		// Update to excluded
+		updateControlQuery := `
+			mutation UpdateControl($input: UpdateControlInput!) {
+				updateControl(input: $input) {
+					control {
+						id
+						status
+						exclusionJustification
+					}
+				}
+			}
+		`
+
+		var updateResult struct {
+			UpdateControl struct {
+				Control struct {
+					ID                     string `json:"id"`
+					Status                 string `json:"status"`
+					ExclusionJustification string `json:"exclusionJustification"`
+				} `json:"control"`
+			} `json:"updateControl"`
+		}
+
+		err = owner.Execute(updateControlQuery, map[string]any{
+			"input": map[string]any{
+				"id":                     createResult.CreateControl.ControlEdge.Node.ID,
+				"status":                 "EXCLUDED",
+				"exclusionJustification": "Decided to exclude",
+			},
+		}, &updateResult)
+		require.NoError(t, err)
+	})
+}

e2e/console/document_version_test.go

@@ -0,0 +1,459 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+// createTestDocument creates a document and returns its ID and the document version ID
+func createTestDocument(t *testing.T, owner *testutil.Client) (docID string, docVersionID string) {
+	t.Helper()
+	peopleID := factory.NewPeople(owner).WithFullName("Doc Owner").Create()
+
+	query := `
+		mutation CreateDocument($input: CreateDocumentInput!) {
+			createDocument(input: $input) {
+				documentEdge {
+					node {
+						id
+						versions(first: 1) {
+							edges {
+								node {
+									id
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateDocument struct {
+			DocumentEdge struct {
+				Node struct {
+					ID       string `json:"id"`
+					Versions struct {
+						Edges []struct {
+							Node struct {
+								ID string `json:"id"`
+							} `json:"node"`
+						} `json:"edges"`
+					} `json:"versions"`
+				} `json:"node"`
+			} `json:"documentEdge"`
+		} `json:"createDocument"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"title":          "Test Document",
+			"content":        "Initial content",
+			"ownerId":        peopleID,
+			"documentType":   "POLICY",
+			"classification": "INTERNAL",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	docID = result.CreateDocument.DocumentEdge.Node.ID
+	if len(result.CreateDocument.DocumentEdge.Node.Versions.Edges) > 0 {
+		docVersionID = result.CreateDocument.DocumentEdge.Node.Versions.Edges[0].Node.ID
+	}
+	return docID, docVersionID
+}
+
+func TestDocumentVersion_PublishVersion(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	docID, _ := createTestDocument(t, owner)
+
+	query := `
+		mutation PublishDocumentVersion($input: PublishDocumentVersionInput!) {
+			publishDocumentVersion(input: $input) {
+				documentVersion {
+					id
+					status
+					version
+					changelog
+				}
+				document {
+					id
+				}
+			}
+		}
+	`
+
+	var result struct {
+		PublishDocumentVersion struct {
+			DocumentVersion struct {
+				ID        string `json:"id"`
+				Status    string `json:"status"`
+				Version   int    `json:"version"`
+				Changelog string `json:"changelog"`
+			} `json:"documentVersion"`
+			Document struct {
+				ID string `json:"id"`
+			} `json:"document"`
+		} `json:"publishDocumentVersion"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentId": docID,
+			"changelog":  "Initial release",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, "PUBLISHED", result.PublishDocumentVersion.DocumentVersion.Status)
+	assert.Equal(t, 1, result.PublishDocumentVersion.DocumentVersion.Version)
+	assert.Equal(t, "Initial release", result.PublishDocumentVersion.DocumentVersion.Changelog)
+}
+
+func TestDocumentVersion_CreateDraft(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create and publish a document first
+	docID, _ := createTestDocument(t, owner)
+
+	publishQuery := `
+		mutation PublishDocumentVersion($input: PublishDocumentVersionInput!) {
+			publishDocumentVersion(input: $input) {
+				documentVersion {
+					id
+				}
+			}
+		}
+	`
+
+	_, err := owner.Do(publishQuery, map[string]any{
+		"input": map[string]any{
+			"documentId": docID,
+			"changelog":  "Initial release",
+		},
+	})
+	require.NoError(t, err)
+
+	query := `
+		mutation CreateDraftDocumentVersion($input: CreateDraftDocumentVersionInput!) {
+			createDraftDocumentVersion(input: $input) {
+				documentVersionEdge {
+					node {
+						id
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateDraftDocumentVersion struct {
+			DocumentVersionEdge struct {
+				Node struct {
+					ID     string `json:"id"`
+					Status string `json:"status"`
+				} `json:"node"`
+			} `json:"documentVersionEdge"`
+		} `json:"createDraftDocumentVersion"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentID": docID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, "DRAFT", result.CreateDraftDocumentVersion.DocumentVersionEdge.Node.Status)
+}
+
+func TestDocumentVersion_UpdateContent(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	_, draftVersionID := createTestDocument(t, owner)
+
+	query := `
+		mutation UpdateDocumentVersion($input: UpdateDocumentVersionInput!) {
+			updateDocumentVersion(input: $input) {
+				documentVersion {
+					id
+					content
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateDocumentVersion struct {
+			DocumentVersion struct {
+				ID      string `json:"id"`
+				Content string `json:"content"`
+			} `json:"documentVersion"`
+		} `json:"updateDocumentVersion"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentVersionId": draftVersionID,
+			"content":           "Updated content for the document",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, "Updated content for the document", result.UpdateDocumentVersion.DocumentVersion.Content)
+}
+
+func TestDocumentVersion_RequestSignature(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create and publish a document
+	docID, _ := createTestDocument(t, owner)
+
+	publishQuery := `
+		mutation PublishDocumentVersion($input: PublishDocumentVersionInput!) {
+			publishDocumentVersion(input: $input) {
+				documentVersion {
+					id
+				}
+			}
+		}
+	`
+
+	var publishResult struct {
+		PublishDocumentVersion struct {
+			DocumentVersion struct {
+				ID string `json:"id"`
+			} `json:"documentVersion"`
+		} `json:"publishDocumentVersion"`
+	}
+
+	err := owner.Execute(publishQuery, map[string]any{
+		"input": map[string]any{
+			"documentId": docID,
+			"changelog":  "Initial release",
+		},
+	}, &publishResult)
+	require.NoError(t, err)
+
+	publishedVersionID := publishResult.PublishDocumentVersion.DocumentVersion.ID
+
+	// Create a person to sign
+	signerID := factory.NewPeople(owner).WithFullName("Document Signer").Create()
+
+	query := `
+		mutation RequestSignature($input: RequestSignatureInput!) {
+			requestSignature(input: $input) {
+				documentVersionSignatureEdge {
+					node {
+						id
+						state
+						signedBy {
+							id
+							fullName
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		RequestSignature struct {
+			DocumentVersionSignatureEdge struct {
+				Node struct {
+					ID       string `json:"id"`
+					State    string `json:"state"`
+					SignedBy struct {
+						ID       string `json:"id"`
+						FullName string `json:"fullName"`
+					} `json:"signedBy"`
+				} `json:"node"`
+			} `json:"documentVersionSignatureEdge"`
+		} `json:"requestSignature"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentVersionId": publishedVersionID,
+			"signatoryId":       signerID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.NotEmpty(t, result.RequestSignature.DocumentVersionSignatureEdge.Node.ID)
+	assert.Equal(t, "REQUESTED", result.RequestSignature.DocumentVersionSignatureEdge.Node.State)
+	assert.Equal(t, signerID, result.RequestSignature.DocumentVersionSignatureEdge.Node.SignedBy.ID)
+}
+
+func TestDocumentVersion_BulkPublish(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create multiple documents
+	docID1, _ := createTestDocument(t, owner)
+	docID2, _ := createTestDocument(t, owner)
+
+	query := `
+		mutation BulkPublishDocumentVersions($input: BulkPublishDocumentVersionsInput!) {
+			bulkPublishDocumentVersions(input: $input) {
+				documentVersionEdges {
+					node {
+						id
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		BulkPublishDocumentVersions struct {
+			DocumentVersionEdges []struct {
+				Node struct {
+					ID     string `json:"id"`
+					Status string `json:"status"`
+				} `json:"node"`
+			} `json:"documentVersionEdges"`
+		} `json:"bulkPublishDocumentVersions"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentIds": []string{docID1, docID2},
+			"changelog":   "Bulk publish release",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, len(result.BulkPublishDocumentVersions.DocumentVersionEdges))
+	for _, edge := range result.BulkPublishDocumentVersions.DocumentVersionEdges {
+		assert.Equal(t, "PUBLISHED", edge.Node.Status)
+	}
+}
+
+func TestDocumentVersion_BulkRequestSignatures(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create and publish a document
+	docID, _ := createTestDocument(t, owner)
+
+	publishQuery := `
+		mutation PublishDocumentVersion($input: PublishDocumentVersionInput!) {
+			publishDocumentVersion(input: $input) {
+				documentVersion {
+					id
+				}
+			}
+		}
+	`
+
+	_, err := owner.Do(publishQuery, map[string]any{
+		"input": map[string]any{
+			"documentId": docID,
+			"changelog":  "Initial release",
+		},
+	})
+	require.NoError(t, err)
+
+	// Create multiple signers
+	signer1ID := factory.NewPeople(owner).WithFullName("Bulk Signer 1").Create()
+	signer2ID := factory.NewPeople(owner).WithFullName("Bulk Signer 2").Create()
+
+	query := `
+		mutation BulkRequestSignatures($input: BulkRequestSignaturesInput!) {
+			bulkRequestSignatures(input: $input) {
+				documentVersionSignatureEdges {
+					node {
+						id
+						state
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		BulkRequestSignatures struct {
+			DocumentVersionSignatureEdges []struct {
+				Node struct {
+					ID    string `json:"id"`
+					State string `json:"state"`
+				} `json:"node"`
+			} `json:"documentVersionSignatureEdges"`
+		} `json:"bulkRequestSignatures"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentIds":  []string{docID},
+			"signatoryIds": []string{signer1ID, signer2ID},
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, len(result.BulkRequestSignatures.DocumentVersionSignatureEdges))
+	for _, edge := range result.BulkRequestSignatures.DocumentVersionSignatureEdges {
+		assert.Equal(t, "REQUESTED", edge.Node.State)
+	}
+}
+
+func TestDocumentVersion_BulkDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create multiple documents to delete
+	docID1, _ := createTestDocument(t, owner)
+	docID2, _ := createTestDocument(t, owner)
+
+	query := `
+		mutation BulkDeleteDocuments($input: BulkDeleteDocumentsInput!) {
+			bulkDeleteDocuments(input: $input) {
+				deletedDocumentIds
+			}
+		}
+	`
+
+	var result struct {
+		BulkDeleteDocuments struct {
+			DeletedDocumentIds []string `json:"deletedDocumentIds"`
+		} `json:"bulkDeleteDocuments"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"documentIds": []string{docID1, docID2},
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, len(result.BulkDeleteDocuments.DeletedDocumentIds))
+	assert.Contains(t, result.BulkDeleteDocuments.DeletedDocumentIds, docID1)
+	assert.Contains(t, result.BulkDeleteDocuments.DeletedDocumentIds, docID2)
+}

e2e/console/main_test.go

@@ -0,0 +1,30 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+// Package console_test contains end-to-end tests for the Console GraphQL API.
+package console_test
+
+import (
+	"os"
+	"testing"
+
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestMain(m *testing.M) {
+	testutil.Setup()
+	code := m.Run()
+	testutil.Teardown()
+	os.Exit(code)
+}

e2e/console/mapping_test.go

@@ -0,0 +1,946 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestControlMeasureMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for Mapping",
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	// Create a control
+	var createControlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Control for Mapping",
+			"description":  "Test control for mapping",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createControlResult)
+	require.NoError(t, err)
+	controlID := createControlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create a measure
+	var createMeasureResult struct {
+		CreateMeasure struct {
+			MeasureEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"measureEdge"`
+		} `json:"createMeasure"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateMeasureInput!) {
+			createMeasure(input: $input) {
+				measureEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Measure for Mapping",
+			"category":       "POLICY",
+		},
+	}, &createMeasureResult)
+	require.NoError(t, err)
+	measureID := createMeasureResult.CreateMeasure.MeasureEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		var result struct {
+			CreateControlMeasureMapping struct {
+				ControlEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"controlEdge"`
+				MeasureEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"measureEdge"`
+			} `json:"createControlMeasureMapping"`
+		}
+		err := owner.Execute(`
+			mutation($input: CreateControlMeasureMappingInput!) {
+				createControlMeasureMapping(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+					measureEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId": controlID,
+				"measureId": measureID,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, controlID, result.CreateControlMeasureMapping.ControlEdge.Node.ID)
+		assert.Equal(t, measureID, result.CreateControlMeasureMapping.MeasureEdge.Node.ID)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteControlMeasureMappingInput!) {
+				deleteControlMeasureMapping(input: $input) {
+					deletedControlId
+					deletedMeasureId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId": controlID,
+				"measureId": measureID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestRiskMeasureMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a risk
+	var createRiskResult struct {
+		CreateRisk struct {
+			RiskEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"riskEdge"`
+		} `json:"createRisk"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateRiskInput!) {
+			createRisk(input: $input) {
+				riskEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId":     owner.GetOrganizationID().String(),
+			"name":               "Risk for Mapping",
+			"category":           "Operational",
+			"treatment":          "MITIGATED",
+			"inherentLikelihood": 3,
+			"inherentImpact":     3,
+		},
+	}, &createRiskResult)
+	require.NoError(t, err)
+	riskID := createRiskResult.CreateRisk.RiskEdge.Node.ID
+
+	// Create a measure
+	var createMeasureResult struct {
+		CreateMeasure struct {
+			MeasureEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"measureEdge"`
+		} `json:"createMeasure"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateMeasureInput!) {
+			createMeasure(input: $input) {
+				measureEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Measure for Risk Mapping",
+			"category":       "TECHNICAL",
+		},
+	}, &createMeasureResult)
+	require.NoError(t, err)
+	measureID := createMeasureResult.CreateMeasure.MeasureEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		var result struct {
+			CreateRiskMeasureMapping struct {
+				RiskEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"riskEdge"`
+				MeasureEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"measureEdge"`
+			} `json:"createRiskMeasureMapping"`
+		}
+		err := owner.Execute(`
+			mutation($input: CreateRiskMeasureMappingInput!) {
+				createRiskMeasureMapping(input: $input) {
+					riskEdge {
+						node {
+							id
+						}
+					}
+					measureEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":    riskID,
+				"measureId": measureID,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, riskID, result.CreateRiskMeasureMapping.RiskEdge.Node.ID)
+		assert.Equal(t, measureID, result.CreateRiskMeasureMapping.MeasureEdge.Node.ID)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteRiskMeasureMappingInput!) {
+				deleteRiskMeasureMapping(input: $input) {
+					deletedRiskId
+					deletedMeasureId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":    riskID,
+				"measureId": measureID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestControlDocumentMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework and control
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for ControlDoc Mapping",
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	var createControlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Control for Document Mapping",
+			"description":  "Test control",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createControlResult)
+	require.NoError(t, err)
+	controlID := createControlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create a document
+	peopleID := factory.NewPeople(owner).WithFullName("Doc Owner").Create()
+	var createDocumentResult struct {
+		CreateDocument struct {
+			DocumentEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"documentEdge"`
+		} `json:"createDocument"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateDocumentInput!) {
+			createDocument(input: $input) {
+				documentEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"title":          "Document for Control Mapping",
+			"content":        "Document content",
+			"ownerId":        peopleID,
+			"documentType":   "POLICY",
+			"classification": "INTERNAL",
+		},
+	}, &createDocumentResult)
+	require.NoError(t, err)
+	documentID := createDocumentResult.CreateDocument.DocumentEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateControlDocumentMappingInput!) {
+				createControlDocumentMapping(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+					documentEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId":  controlID,
+				"documentId": documentID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteControlDocumentMappingInput!) {
+				deleteControlDocumentMapping(input: $input) {
+					deletedControlId
+					deletedDocumentId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId":  controlID,
+				"documentId": documentID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestControlAuditMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework and control
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for ControlAudit Mapping",
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	var createControlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Control for Audit Mapping",
+			"description":  "Test control",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createControlResult)
+	require.NoError(t, err)
+	controlID := createControlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create an audit
+	var createAuditResult struct {
+		CreateAudit struct {
+			AuditEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"auditEdge"`
+		} `json:"createAudit"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateAuditInput!) {
+			createAudit(input: $input) {
+				auditEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"frameworkId":    frameworkID,
+			"name":           "Audit for Control Mapping",
+		},
+	}, &createAuditResult)
+	require.NoError(t, err)
+	auditID := createAuditResult.CreateAudit.AuditEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateControlAuditMappingInput!) {
+				createControlAuditMapping(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+					auditEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId": controlID,
+				"auditId":   auditID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteControlAuditMappingInput!) {
+				deleteControlAuditMapping(input: $input) {
+					deletedControlId
+					deletedAuditId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId": controlID,
+				"auditId":   auditID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestControlSnapshotMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a framework and control
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for ControlSnapshot Mapping",
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	var createControlResult struct {
+		CreateControl struct {
+			ControlEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"controlEdge"`
+		} `json:"createControl"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateControlInput!) {
+			createControl(input: $input) {
+				controlEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"frameworkId":  frameworkID,
+			"name":         "Control for Snapshot Mapping",
+			"description":  "Test control",
+			"sectionTitle": "Section 1",
+			"status":       "INCLUDED",
+		},
+	}, &createControlResult)
+	require.NoError(t, err)
+	controlID := createControlResult.CreateControl.ControlEdge.Node.ID
+
+	// Create a snapshot
+	var createSnapshotResult struct {
+		CreateSnapshot struct {
+			SnapshotEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"snapshotEdge"`
+		} `json:"createSnapshot"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateSnapshotInput!) {
+			createSnapshot(input: $input) {
+				snapshotEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Snapshot for Control Mapping",
+			"type":           "RISKS",
+		},
+	}, &createSnapshotResult)
+	require.NoError(t, err)
+	snapshotID := createSnapshotResult.CreateSnapshot.SnapshotEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateControlSnapshotMappingInput!) {
+				createControlSnapshotMapping(input: $input) {
+					controlEdge {
+						node {
+							id
+						}
+					}
+					snapshotEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId":  controlID,
+				"snapshotId": snapshotID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteControlSnapshotMappingInput!) {
+				deleteControlSnapshotMapping(input: $input) {
+					deletedControlId
+					deletedSnapshotId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"controlId":  controlID,
+				"snapshotId": snapshotID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestRiskDocumentMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a risk
+	var createRiskResult struct {
+		CreateRisk struct {
+			RiskEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"riskEdge"`
+		} `json:"createRisk"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateRiskInput!) {
+			createRisk(input: $input) {
+				riskEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId":     owner.GetOrganizationID().String(),
+			"name":               "Risk for Document Mapping",
+			"category":           "Operational",
+			"treatment":          "MITIGATED",
+			"inherentLikelihood": 3,
+			"inherentImpact":     3,
+		},
+	}, &createRiskResult)
+	require.NoError(t, err)
+	riskID := createRiskResult.CreateRisk.RiskEdge.Node.ID
+
+	// Create a document
+	peopleID := factory.NewPeople(owner).WithFullName("Doc Owner").Create()
+	var createDocumentResult struct {
+		CreateDocument struct {
+			DocumentEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"documentEdge"`
+		} `json:"createDocument"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateDocumentInput!) {
+			createDocument(input: $input) {
+				documentEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"title":          "Document for Risk Mapping",
+			"content":        "Document content",
+			"ownerId":        peopleID,
+			"documentType":   "POLICY",
+			"classification": "INTERNAL",
+		},
+	}, &createDocumentResult)
+	require.NoError(t, err)
+	documentID := createDocumentResult.CreateDocument.DocumentEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateRiskDocumentMappingInput!) {
+				createRiskDocumentMapping(input: $input) {
+					riskEdge {
+						node {
+							id
+						}
+					}
+					documentEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":     riskID,
+				"documentId": documentID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteRiskDocumentMappingInput!) {
+				deleteRiskDocumentMapping(input: $input) {
+					deletedRiskId
+					deletedDocumentId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":     riskID,
+				"documentId": documentID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
+func TestRiskObligationMapping_CreateDelete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a risk
+	var createRiskResult struct {
+		CreateRisk struct {
+			RiskEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"riskEdge"`
+		} `json:"createRisk"`
+	}
+	err := owner.Execute(`
+		mutation($input: CreateRiskInput!) {
+			createRisk(input: $input) {
+				riskEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId":     owner.GetOrganizationID().String(),
+			"name":               "Risk for Obligation Mapping",
+			"category":           "Compliance",
+			"treatment":          "MITIGATED",
+			"inherentLikelihood": 2,
+			"inherentImpact":     4,
+		},
+	}, &createRiskResult)
+	require.NoError(t, err)
+	riskID := createRiskResult.CreateRisk.RiskEdge.Node.ID
+
+	// Create an obligation
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+	var createObligationResult struct {
+		CreateObligation struct {
+			ObligationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"obligationEdge"`
+		} `json:"createObligation"`
+	}
+	err = owner.Execute(`
+		mutation($input: CreateObligationInput!) {
+			createObligation(input: $input) {
+				obligationEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"area":           "Risk Management",
+			"requirement":    "Obligation for Risk Mapping",
+			"ownerId":        peopleID,
+			"status":         "NON_COMPLIANT",
+		},
+	}, &createObligationResult)
+	require.NoError(t, err)
+	obligationID := createObligationResult.CreateObligation.ObligationEdge.Node.ID
+
+	t.Run("create mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: CreateRiskObligationMappingInput!) {
+				createRiskObligationMapping(input: $input) {
+					riskEdge {
+						node {
+							id
+						}
+					}
+					obligationEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":       riskID,
+				"obligationId": obligationID,
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete mapping", func(t *testing.T) {
+		_, err := owner.Do(`
+			mutation($input: DeleteRiskObligationMappingInput!) {
+				deleteRiskObligationMapping(input: $input) {
+					deletedRiskId
+					deletedObligationId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"riskId":       riskID,
+				"obligationId": obligationID,
+			},
+		})
+		require.NoError(t, err)
+	})
+}

e2e/console/member_test.go

@@ -0,0 +1,315 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestMember_UpdateMembership(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create an admin to update
+	_ = testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
+
+	// Get the member ID of the admin
+	query := `
+		query($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					memberships(first: 10) {
+						edges {
+							node {
+								id
+								role
+								userID
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Memberships struct {
+				Edges []struct {
+					Node struct {
+						ID     string `json:"id"`
+						Role   string `json:"role"`
+						UserID string `json:"userID"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"memberships"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	// Find the admin member
+	var adminMemberID string
+	for _, edge := range result.Node.Memberships.Edges {
+		if edge.Node.Role == "ADMIN" {
+			adminMemberID = edge.Node.ID
+			break
+		}
+	}
+	require.NotEmpty(t, adminMemberID, "Should find admin member")
+
+	// Update the member role to VIEWER
+	mutation := `
+		mutation($input: UpdateMembershipInput!) {
+			updateMembership(input: $input) {
+				membership {
+					id
+					role
+				}
+			}
+		}
+	`
+
+	var mutationResult struct {
+		UpdateMembership struct {
+			Membership struct {
+				ID   string `json:"id"`
+				Role string `json:"role"`
+			} `json:"membership"`
+		} `json:"updateMembership"`
+	}
+
+	err = owner.Execute(mutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"memberId":       adminMemberID,
+			"role":           "VIEWER",
+		},
+	}, &mutationResult)
+	require.NoError(t, err)
+
+	assert.Equal(t, "VIEWER", mutationResult.UpdateMembership.Membership.Role)
+}
+
+func TestMember_RemoveMember(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a member to remove
+	memberToRemove := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
+	_ = memberToRemove
+
+	// Get the member ID
+	query := `
+		query($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					memberships(first: 50) {
+						edges {
+							node {
+								id
+								role
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Memberships struct {
+				Edges []struct {
+					Node struct {
+						ID   string `json:"id"`
+						Role string `json:"role"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"memberships"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	// Find a viewer member to remove
+	var memberID string
+	for _, edge := range result.Node.Memberships.Edges {
+		if edge.Node.Role == "VIEWER" {
+			memberID = edge.Node.ID
+			break
+		}
+	}
+	assert.NotEmpty(t, memberID, "Should find viewer member")
+
+	// Remove the member
+	mutation := `
+		mutation($input: RemoveMemberInput!) {
+			removeMember(input: $input) {
+				deletedMemberId
+			}
+		}
+	`
+
+	var mutationResult struct {
+		RemoveMember struct {
+			DeletedMemberID string `json:"deletedMemberId"`
+		} `json:"removeMember"`
+	}
+
+	err = owner.Execute(mutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"memberId":       memberID,
+		},
+	}, &mutationResult)
+	require.NoError(t, err)
+
+	assert.Equal(t, memberID, mutationResult.RemoveMember.DeletedMemberID)
+}
+
+func TestInvitation_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create an invitation
+	inviteMutation := `
+		mutation($input: InviteUserInput!) {
+			inviteUser(input: $input) {
+				invitationEdge {
+					node {
+						id
+						email
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var inviteResult struct {
+		InviteUser struct {
+			InvitationEdge struct {
+				Node struct {
+					ID     string `json:"id"`
+					Email  string `json:"email"`
+					Status string `json:"status"`
+				} `json:"node"`
+			} `json:"invitationEdge"`
+		} `json:"inviteUser"`
+	}
+
+	err := owner.Execute(inviteMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"email":          fmt.Sprintf("invite.delete.%d@example.com", time.Now().UnixNano()),
+			"fullName":       "Test User",
+			"role":           "VIEWER",
+			"createPeople":   false,
+		},
+	}, &inviteResult)
+	require.NoError(t, err)
+
+	invitationID := inviteResult.InviteUser.InvitationEdge.Node.ID
+	assert.NotEmpty(t, invitationID)
+
+	// Delete the invitation
+	deleteMutation := `
+		mutation($input: DeleteInvitationInput!) {
+			deleteInvitation(input: $input) {
+				deletedInvitationId
+			}
+		}
+	`
+
+	var deleteResult struct {
+		DeleteInvitation struct {
+			DeletedInvitationID string `json:"deletedInvitationId"`
+		} `json:"deleteInvitation"`
+	}
+
+	err = owner.Execute(deleteMutation, map[string]any{
+		"input": map[string]any{
+			"invitationId": invitationID,
+		},
+	}, &deleteResult)
+	require.NoError(t, err)
+
+	assert.Equal(t, invitationID, deleteResult.DeleteInvitation.DeletedInvitationID)
+}
+
+func TestMember_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create additional members
+	testutil.NewClientInOrg(t, testutil.RoleAdmin, owner)
+	testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
+
+	query := `
+		query($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					memberships(first: 10) {
+						edges {
+							node {
+								id
+								role
+								userID
+								emailAddress
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Memberships struct {
+				Edges []struct {
+					Node struct {
+						ID           string `json:"id"`
+						Role         string `json:"role"`
+						UserID       string `json:"userID"`
+						EmailAddress string `json:"emailAddress"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"memberships"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	assert.GreaterOrEqual(t, result.Node.Memberships.TotalCount, 3, "Should have at least 3 members")
+}

e2e/console/nonconformity_test.go

@@ -0,0 +1,439 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+// createAuditForNC creates a framework and audit for nonconformity testing
+func createAuditForNC(t *testing.T, owner *testutil.Client, name string) string {
+	t.Helper()
+
+	// Create a framework first
+	createFrameworkQuery := `
+		mutation CreateFramework($input: CreateFrameworkInput!) {
+			createFramework(input: $input) {
+				frameworkEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createFrameworkResult struct {
+		CreateFramework struct {
+			FrameworkEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"frameworkEdge"`
+		} `json:"createFramework"`
+	}
+
+	err := owner.Execute(createFrameworkQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Framework for " + name,
+		},
+	}, &createFrameworkResult)
+	require.NoError(t, err)
+	frameworkID := createFrameworkResult.CreateFramework.FrameworkEdge.Node.ID
+
+	// Create an audit
+	createAuditQuery := `
+		mutation CreateAudit($input: CreateAuditInput!) {
+			createAudit(input: $input) {
+				auditEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createAuditResult struct {
+		CreateAudit struct {
+			AuditEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"auditEdge"`
+		} `json:"createAudit"`
+	}
+
+	err = owner.Execute(createAuditQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"frameworkId":    frameworkID,
+			"name":           name,
+			"state":          "NOT_STARTED",
+		},
+	}, &createAuditResult)
+	require.NoError(t, err)
+
+	return createAuditResult.CreateAudit.AuditEdge.Node.ID
+}
+
+func TestNonconformity_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC Test Audit")
+
+	query := `
+		mutation CreateNonconformity($input: CreateNonconformityInput!) {
+			createNonconformity(input: $input) {
+				nonconformityEdge {
+					node {
+						id
+						referenceId
+						description
+						rootCause
+						correctiveAction
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateNonconformity struct {
+			NonconformityEdge struct {
+				Node struct {
+					ID               string `json:"id"`
+					ReferenceID      string `json:"referenceId"`
+					Description      string `json:"description"`
+					RootCause        string `json:"rootCause"`
+					CorrectiveAction string `json:"correctiveAction"`
+					Status           string `json:"status"`
+				} `json:"node"`
+			} `json:"nonconformityEdge"`
+		} `json:"createNonconformity"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId":   owner.GetOrganizationID().String(),
+			"referenceId":      fmt.Sprintf("NC-%d", time.Now().UnixNano()),
+			"description":      "Unauthorized access detected",
+			"auditId":          auditID,
+			"rootCause":        "Insufficient access controls",
+			"correctiveAction": "Implement MFA",
+			"ownerId":          peopleID,
+			"status":           "OPEN",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	nc := result.CreateNonconformity.NonconformityEdge.Node
+	assert.NotEmpty(t, nc.ID)
+	assert.Equal(t, "Unauthorized access detected", nc.Description)
+	assert.Equal(t, "Insufficient access controls", nc.RootCause)
+	assert.Equal(t, "OPEN", nc.Status)
+}
+
+func TestNonconformity_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC Update Test Audit")
+
+	// Create a nonconformity to update
+	createQuery := `
+		mutation CreateNonconformity($input: CreateNonconformityInput!) {
+			createNonconformity(input: $input) {
+				nonconformityEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateNonconformity struct {
+			NonconformityEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"nonconformityEdge"`
+		} `json:"createNonconformity"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("NC-UPDATE-%d", time.Now().UnixNano()),
+			"auditId":        auditID,
+			"rootCause":      "Original root cause",
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	ncID := createResult.CreateNonconformity.NonconformityEdge.Node.ID
+
+	query := `
+		mutation UpdateNonconformity($input: UpdateNonconformityInput!) {
+			updateNonconformity(input: $input) {
+				nonconformity {
+					id
+					rootCause
+					correctiveAction
+					status
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateNonconformity struct {
+			Nonconformity struct {
+				ID               string `json:"id"`
+				RootCause        string `json:"rootCause"`
+				CorrectiveAction string `json:"correctiveAction"`
+				Status           string `json:"status"`
+			} `json:"nonconformity"`
+		} `json:"updateNonconformity"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":               ncID,
+			"rootCause":        "Updated root cause",
+			"correctiveAction": "New corrective action",
+			"status":           "IN_PROGRESS",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	nc := result.UpdateNonconformity.Nonconformity
+	assert.Equal(t, ncID, nc.ID)
+	assert.Equal(t, "Updated root cause", nc.RootCause)
+	assert.Equal(t, "New corrective action", nc.CorrectiveAction)
+	assert.Equal(t, "IN_PROGRESS", nc.Status)
+}
+
+func TestNonconformity_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC Delete Test Audit")
+
+	// Create a nonconformity to delete
+	createQuery := `
+		mutation CreateNonconformity($input: CreateNonconformityInput!) {
+			createNonconformity(input: $input) {
+				nonconformityEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateNonconformity struct {
+			NonconformityEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"nonconformityEdge"`
+		} `json:"createNonconformity"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"referenceId":    fmt.Sprintf("NC-DELETE-%d", time.Now().UnixNano()),
+			"auditId":        auditID,
+			"rootCause":      "Test root cause",
+			"ownerId":        peopleID,
+			"status":         "OPEN",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+	ncID := createResult.CreateNonconformity.NonconformityEdge.Node.ID
+
+	deleteQuery := `
+		mutation DeleteNonconformity($input: DeleteNonconformityInput!) {
+			deleteNonconformity(input: $input) {
+				deletedNonconformityId
+			}
+		}
+	`
+
+	var deleteResult struct {
+		DeleteNonconformity struct {
+			DeletedNonconformityID string `json:"deletedNonconformityId"`
+		} `json:"deleteNonconformity"`
+	}
+
+	err = owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"nonconformityId": ncID,
+		},
+	}, &deleteResult)
+	require.NoError(t, err)
+	assert.Equal(t, ncID, deleteResult.DeleteNonconformity.DeletedNonconformityID)
+}
+
+func TestNonconformity_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC List Test Audit")
+
+	// Create multiple nonconformities
+	createQuery := `
+		mutation CreateNonconformity($input: CreateNonconformityInput!) {
+			createNonconformity(input: $input) {
+				nonconformityEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	for i := 0; i < 3; i++ {
+		var createResult struct {
+			CreateNonconformity struct {
+				NonconformityEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"nonconformityEdge"`
+			} `json:"createNonconformity"`
+		}
+
+		err := owner.Execute(createQuery, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"referenceId":    fmt.Sprintf("NC-LIST-%d-%d", i, time.Now().UnixNano()),
+				"auditId":        auditID,
+				"rootCause":      fmt.Sprintf("Root cause %d", i),
+				"ownerId":        peopleID,
+				"status":         "OPEN",
+			},
+		}, &createResult)
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetNonconformities($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					nonconformities(first: 10) {
+						edges {
+							node {
+								id
+								referenceId
+								status
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Nonconformities struct {
+				Edges []struct {
+					Node struct {
+						ID          string `json:"id"`
+						ReferenceID string `json:"referenceId"`
+						Status      string `json:"status"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"nonconformities"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Nonconformities.TotalCount, 3)
+}
+
+func TestNonconformity_StatusValues(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("NC Owner").Create()
+	auditID := createAuditForNC(t, owner, "NC Status Test Audit")
+
+	statuses := []string{"OPEN", "IN_PROGRESS", "CLOSED"}
+
+	for _, status := range statuses {
+		t.Run(status, func(t *testing.T) {
+			query := `
+				mutation CreateNonconformity($input: CreateNonconformityInput!) {
+					createNonconformity(input: $input) {
+						nonconformityEdge {
+							node {
+								id
+								status
+							}
+						}
+					}
+				}
+			`
+
+			var result struct {
+				CreateNonconformity struct {
+					NonconformityEdge struct {
+						Node struct {
+							ID     string `json:"id"`
+							Status string `json:"status"`
+						} `json:"node"`
+					} `json:"nonconformityEdge"`
+				} `json:"createNonconformity"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"organizationId": owner.GetOrganizationID().String(),
+					"referenceId":    fmt.Sprintf("NC-STATUS-%s-%d", status, time.Now().UnixNano()),
+					"auditId":        auditID,
+					"rootCause":      "Test root cause",
+					"ownerId":        peopleID,
+					"status":         status,
+				},
+			}, &result)
+			require.NoError(t, err)
+			assert.Equal(t, status, result.CreateNonconformity.NonconformityEdge.Node.Status)
+		})
+	}
+}

e2e/console/obligation_test.go

@@ -0,0 +1,352 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestObligation_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	query := `
+		mutation CreateObligation($input: CreateObligationInput!) {
+			createObligation(input: $input) {
+				obligationEdge {
+					node {
+						id
+						area
+						source
+						requirement
+						regulator
+						status
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateObligation struct {
+			ObligationEdge struct {
+				Node struct {
+					ID          string `json:"id"`
+					Area        string `json:"area"`
+					Source      string `json:"source"`
+					Requirement string `json:"requirement"`
+					Regulator   string `json:"regulator"`
+					Status      string `json:"status"`
+				} `json:"node"`
+			} `json:"obligationEdge"`
+		} `json:"createObligation"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"area":           "Data Protection",
+			"source":         "GDPR Article 5",
+			"requirement":    "Data must be processed lawfully",
+			"regulator":      "ICO",
+			"ownerId":        peopleID,
+			"status":         "NON_COMPLIANT",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.NotEmpty(t, result.CreateObligation.ObligationEdge.Node.ID)
+	assert.Equal(t, "Data Protection", result.CreateObligation.ObligationEdge.Node.Area)
+	assert.Equal(t, "GDPR Article 5", result.CreateObligation.ObligationEdge.Node.Source)
+	assert.Equal(t, "Data must be processed lawfully", result.CreateObligation.ObligationEdge.Node.Requirement)
+	assert.Equal(t, "ICO", result.CreateObligation.ObligationEdge.Node.Regulator)
+	assert.Equal(t, "NON_COMPLIANT", result.CreateObligation.ObligationEdge.Node.Status)
+}
+
+func TestObligation_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	// Create an obligation to update
+	createQuery := `
+		mutation CreateObligation($input: CreateObligationInput!) {
+			createObligation(input: $input) {
+				obligationEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateObligation struct {
+			ObligationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"obligationEdge"`
+		} `json:"createObligation"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"area":           "Original Area",
+			"ownerId":        peopleID,
+			"status":         "NON_COMPLIANT",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	obligationID := createResult.CreateObligation.ObligationEdge.Node.ID
+
+	query := `
+		mutation UpdateObligation($input: UpdateObligationInput!) {
+			updateObligation(input: $input) {
+				obligation {
+					id
+					area
+					status
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateObligation struct {
+			Obligation struct {
+				ID     string `json:"id"`
+				Area   string `json:"area"`
+				Status string `json:"status"`
+			} `json:"obligation"`
+		} `json:"updateObligation"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":     obligationID,
+			"area":   "Updated Area",
+			"status": "COMPLIANT",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, obligationID, result.UpdateObligation.Obligation.ID)
+	assert.Equal(t, "Updated Area", result.UpdateObligation.Obligation.Area)
+	assert.Equal(t, "COMPLIANT", result.UpdateObligation.Obligation.Status)
+}
+
+func TestObligation_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	// Create an obligation to delete
+	createQuery := `
+		mutation CreateObligation($input: CreateObligationInput!) {
+			createObligation(input: $input) {
+				obligationEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateObligation struct {
+			ObligationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"obligationEdge"`
+		} `json:"createObligation"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"area":           "Obligation to Delete",
+			"ownerId":        peopleID,
+			"status":         "NON_COMPLIANT",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	obligationID := createResult.CreateObligation.ObligationEdge.Node.ID
+
+	deleteQuery := `
+		mutation DeleteObligation($input: DeleteObligationInput!) {
+			deleteObligation(input: $input) {
+				deletedObligationId
+			}
+		}
+	`
+
+	var deleteResult struct {
+		DeleteObligation struct {
+			DeletedObligationID string `json:"deletedObligationId"`
+		} `json:"deleteObligation"`
+	}
+
+	err = owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"obligationId": obligationID,
+		},
+	}, &deleteResult)
+	require.NoError(t, err)
+	assert.Equal(t, obligationID, deleteResult.DeleteObligation.DeletedObligationID)
+}
+
+func TestObligation_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	// Create multiple obligations
+	areas := []string{"Area A", "Area B", "Area C"}
+	for _, area := range areas {
+		query := `
+			mutation CreateObligation($input: CreateObligationInput!) {
+				createObligation(input: $input) {
+					obligationEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateObligation struct {
+				ObligationEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"obligationEdge"`
+			} `json:"createObligation"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"area":           area,
+				"ownerId":        peopleID,
+				"status":         "NON_COMPLIANT",
+			},
+		}, &result)
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetObligations($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					obligations(first: 10) {
+						edges {
+							node {
+								id
+								area
+								status
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Obligations struct {
+				Edges []struct {
+					Node struct {
+						ID     string `json:"id"`
+						Area   string `json:"area"`
+						Status string `json:"status"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"obligations"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	assert.GreaterOrEqual(t, result.Node.Obligations.TotalCount, 3)
+}
+
+func TestObligation_StatusValues(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.NewPeople(owner).WithFullName("Obligation Owner").Create()
+
+	statuses := []string{"NON_COMPLIANT", "PARTIALLY_COMPLIANT", "COMPLIANT"}
+
+	for _, status := range statuses {
+		t.Run(status, func(t *testing.T) {
+			query := `
+				mutation CreateObligation($input: CreateObligationInput!) {
+					createObligation(input: $input) {
+						obligationEdge {
+							node {
+								id
+								status
+							}
+						}
+					}
+				}
+			`
+
+			var result struct {
+				CreateObligation struct {
+					ObligationEdge struct {
+						Node struct {
+							ID     string `json:"id"`
+							Status string `json:"status"`
+						} `json:"node"`
+					} `json:"obligationEdge"`
+				} `json:"createObligation"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"organizationId": owner.GetOrganizationID().String(),
+					"area":           "Status Test " + status,
+					"ownerId":        peopleID,
+					"status":         status,
+				},
+			}, &result)
+			require.NoError(t, err)
+
+			assert.Equal(t, status, result.CreateObligation.ObligationEdge.Node.Status)
+		})
+	}
+}

e2e/console/organization_test.go

@@ -0,0 +1,186 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestOrganization_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	t.Run("update name and description", func(t *testing.T) {
+		newName := fmt.Sprintf("Updated Org %d", time.Now().UnixNano())
+
+		query := `
+			mutation UpdateOrganization($input: UpdateOrganizationInput!) {
+				updateOrganization(input: $input) {
+					organization {
+						id
+						name
+						description
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateOrganization struct {
+				Organization struct {
+					ID          string `json:"id"`
+					Name        string `json:"name"`
+					Description string `json:"description"`
+				} `json:"organization"`
+			} `json:"updateOrganization"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"name":           newName,
+				"description":    "Updated organization description",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, owner.GetOrganizationID().String(), result.UpdateOrganization.Organization.ID)
+		assert.Equal(t, newName, result.UpdateOrganization.Organization.Name)
+		assert.Equal(t, "Updated organization description", result.UpdateOrganization.Organization.Description)
+	})
+
+	t.Run("update website and email", func(t *testing.T) {
+		query := `
+			mutation UpdateOrganization($input: UpdateOrganizationInput!) {
+				updateOrganization(input: $input) {
+					organization {
+						id
+						websiteUrl
+						email
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateOrganization struct {
+				Organization struct {
+					ID         string `json:"id"`
+					WebsiteUrl string `json:"websiteUrl"`
+					Email      string `json:"email"`
+				} `json:"organization"`
+			} `json:"updateOrganization"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"websiteUrl":     "https://example.com",
+				"email":          "contact@example.com",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, "https://example.com", result.UpdateOrganization.Organization.WebsiteUrl)
+		assert.Equal(t, "contact@example.com", result.UpdateOrganization.Organization.Email)
+	})
+
+	t.Run("update headquarter address", func(t *testing.T) {
+		query := `
+			mutation UpdateOrganization($input: UpdateOrganizationInput!) {
+				updateOrganization(input: $input) {
+					organization {
+						id
+						headquarterAddress
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateOrganization struct {
+				Organization struct {
+					ID                 string `json:"id"`
+					HeadquarterAddress string `json:"headquarterAddress"`
+				} `json:"organization"`
+			} `json:"updateOrganization"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId":     owner.GetOrganizationID().String(),
+				"headquarterAddress": "123 Main St, Suite 100, San Francisco, CA 94102",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		assert.Equal(t, "123 Main St, Suite 100, San Francisco, CA 94102", result.UpdateOrganization.Organization.HeadquarterAddress)
+	})
+}
+
+func TestOrganization_UpdateContext(t *testing.T) {
+	t.Skip("updateOrganizationContext mutation not implemented")
+}
+
+func TestOrganization_Get(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	query := `
+		query GetOrganization($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					id
+					name
+					description
+					websiteUrl
+					email
+					headquarterAddress
+					context {
+						summary
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ID                 string `json:"id"`
+			Name               string `json:"name"`
+			Description        string `json:"description"`
+			WebsiteUrl         string `json:"websiteUrl"`
+			Email              string `json:"email"`
+			HeadquarterAddress string `json:"headquarterAddress"`
+			Context            struct {
+				Summary string `json:"summary"`
+			} `json:"context"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, owner.GetOrganizationID().String(), result.Node.ID)
+	assert.NotEmpty(t, result.Node.Name)
+}

e2e/console/people_test.go

@@ -0,0 +1,670 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestPeople_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	t.Run("with full details", func(t *testing.T) {
+		query := `
+			mutation CreatePeople($input: CreatePeopleInput!) {
+				createPeople(input: $input) {
+					peopleEdge {
+						node {
+							id
+							fullName
+							kind
+							position
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreatePeople struct {
+				PeopleEdge struct {
+					Node struct {
+						ID       string  `json:"id"`
+						FullName string  `json:"fullName"`
+						Kind     string  `json:"kind"`
+						Position *string `json:"position"`
+					} `json:"node"`
+				} `json:"peopleEdge"`
+			} `json:"createPeople"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId":      owner.GetOrganizationID().String(),
+				"fullName":            "John Doe",
+				"primaryEmailAddress": "john.doe@example.com",
+				"kind":                "EMPLOYEE",
+				"position":            "Software Engineer",
+			},
+		}, &result)
+		require.NoError(t, err)
+
+		people := result.CreatePeople.PeopleEdge.Node
+		assert.NotEmpty(t, people.ID)
+		assert.Equal(t, "John Doe", people.FullName)
+		assert.Equal(t, "EMPLOYEE", people.Kind)
+		assert.Equal(t, "Software Engineer", *people.Position)
+	})
+
+	t.Run("with different kinds", func(t *testing.T) {
+		kinds := []struct {
+			name string
+			kind string
+		}{
+			{"Employee", "EMPLOYEE"},
+			{"Contractor", "CONTRACTOR"},
+			{"Service Account", "SERVICE_ACCOUNT"},
+		}
+
+		for _, tt := range kinds {
+			t.Run(tt.name, func(t *testing.T) {
+				peopleID := factory.CreatePeople(owner, factory.Attrs{
+					"fullName": "Person " + tt.kind,
+					"kind":     tt.kind,
+				})
+
+				query := `
+					query GetPeople($id: ID!) {
+						node(id: $id) {
+							... on People {
+								id
+								kind
+							}
+						}
+					}
+				`
+
+				var result struct {
+					Node struct {
+						ID   string `json:"id"`
+						Kind string `json:"kind"`
+					} `json:"node"`
+				}
+
+				err := owner.Execute(query, map[string]any{"id": peopleID}, &result)
+				require.NoError(t, err)
+				assert.Equal(t, tt.kind, result.Node.Kind)
+			})
+		}
+	})
+
+	t.Run("with additional emails", func(t *testing.T) {
+		t.Skip("additionalEmailAddresses feature not fully implemented")
+	})
+}
+
+func TestPeople_Update(t *testing.T) {
+	t.Skip("updatePeople has server bug with additional_email_addresses null constraint")
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.CreatePeople(owner, factory.Attrs{
+		"fullName": "Person to Update",
+	})
+
+	query := `
+		mutation UpdatePeople($input: UpdatePeopleInput!) {
+			updatePeople(input: $input) {
+				people {
+					id
+					fullName
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdatePeople struct {
+			People struct {
+				ID       string `json:"id"`
+				FullName string `json:"fullName"`
+			} `json:"people"`
+		} `json:"updatePeople"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":       peopleID,
+			"fullName": "Updated Name",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, peopleID, result.UpdatePeople.People.ID)
+	assert.Equal(t, "Updated Name", result.UpdatePeople.People.FullName)
+}
+
+func TestPeople_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	peopleID := factory.CreatePeople(owner, factory.Attrs{
+		"fullName": "Person to Delete",
+	})
+
+	query := `
+		mutation DeletePeople($input: DeletePeopleInput!) {
+			deletePeople(input: $input) {
+				deletedPeopleId
+			}
+		}
+	`
+
+	var result struct {
+		DeletePeople struct {
+			DeletedPeopleID string `json:"deletedPeopleId"`
+		} `json:"deletePeople"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"peopleId": peopleID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, peopleID, result.DeletePeople.DeletedPeopleID)
+}
+
+func TestPeople_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create multiple people
+	peopleNames := []string{"Person A", "Person B", "Person C"}
+	for _, name := range peopleNames {
+		factory.CreatePeople(owner, factory.Attrs{"fullName": name})
+	}
+
+	query := `
+		query ListPeoples($orgId: ID!) {
+			node(id: $orgId) {
+				... on Organization {
+					peoples(first: 10) {
+						edges {
+							node {
+								id
+								fullName
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Peoples struct {
+				Edges []struct {
+					Node struct {
+						ID       string `json:"id"`
+						FullName string `json:"fullName"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"peoples"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"orgId": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Peoples.TotalCount, 3)
+}
+
+func TestPeople_RequiredFields(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	tests := []struct {
+		name              string
+		input             map[string]any
+		skipOrganization  bool
+		wantErrorContains string
+	}{
+		{
+			name: "missing organizationId",
+			input: map[string]any{
+				"fullName":            "Test Person",
+				"primaryEmailAddress": "test@example.com",
+				"kind":                "EMPLOYEE",
+			},
+			skipOrganization:  true,
+			wantErrorContains: "organizationId",
+		},
+		{
+			name: "missing fullName",
+			input: map[string]any{
+				"primaryEmailAddress": "test@example.com",
+				"kind":                "EMPLOYEE",
+			},
+			wantErrorContains: "fullName",
+		},
+		{
+			name: "missing primaryEmailAddress",
+			input: map[string]any{
+				"fullName": "Test Person",
+				"kind":     "EMPLOYEE",
+			},
+			wantErrorContains: "primaryEmailAddress",
+		},
+		{
+			name: "missing kind",
+			input: map[string]any{
+				"fullName":            "Test Person",
+				"primaryEmailAddress": "test@example.com",
+			},
+			wantErrorContains: "kind",
+		},
+		{
+			name: "empty fullName",
+			input: map[string]any{
+				"fullName":            "",
+				"primaryEmailAddress": "test@example.com",
+				"kind":                "EMPLOYEE",
+			},
+			wantErrorContains: "full_name",
+		},
+		{
+			name: "invalid kind enum",
+			input: map[string]any{
+				"fullName":            "Test Person",
+				"primaryEmailAddress": "test@example.com",
+				"kind":                "INVALID_KIND",
+			},
+			wantErrorContains: "kind",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			query := `
+				mutation CreatePeople($input: CreatePeopleInput!) {
+					createPeople(input: $input) {
+						peopleEdge {
+							node {
+								id
+							}
+						}
+					}
+				}
+			`
+
+			input := make(map[string]any)
+			if !tt.skipOrganization {
+				input["organizationId"] = owner.GetOrganizationID().String()
+			}
+			for k, v := range tt.input {
+				input[k] = v
+			}
+
+			_, err := owner.Do(query, map[string]any{"input": input})
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.wantErrorContains)
+		})
+	}
+}
+
+func TestPeople_KindEnum(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	kinds := []string{
+		"EMPLOYEE",
+		"CONTRACTOR",
+	}
+
+	for _, kind := range kinds {
+		t.Run("create with kind "+kind, func(t *testing.T) {
+			peopleID := factory.NewPeople(owner).
+				WithFullName("Kind Test " + kind).
+				WithKind(kind).
+				Create()
+
+			query := `
+				query($id: ID!) {
+					node(id: $id) {
+						... on People {
+							id
+							kind
+						}
+					}
+				}
+			`
+
+			var result struct {
+				Node struct {
+					ID   string `json:"id"`
+					Kind string `json:"kind"`
+				} `json:"node"`
+			}
+
+			err := owner.Execute(query, map[string]any{"id": peopleID}, &result)
+			require.NoError(t, err)
+			assert.Equal(t, kind, result.Node.Kind)
+		})
+	}
+}
+
+func TestPeople_SubResolvers(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("SubResolver Test Person").
+		Create()
+
+	t.Run("people node query", func(t *testing.T) {
+		query := `
+			query GetPeople($id: ID!) {
+				node(id: $id) {
+					... on People {
+						id
+						fullName
+						primaryEmailAddress
+						kind
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID                  string `json:"id"`
+				FullName            string `json:"fullName"`
+				PrimaryEmailAddress string `json:"primaryEmailAddress"`
+				Kind                string `json:"kind"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": peopleID}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, peopleID, result.Node.ID)
+		assert.Equal(t, "SubResolver Test Person", result.Node.FullName)
+	})
+
+}
+
+func TestPeople_InvalidID(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	t.Run("update with invalid ID", func(t *testing.T) {
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+					}
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"id":       "invalid-id-format",
+				"fullName": "Test",
+			},
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "base64")
+	})
+
+	t.Run("delete with invalid ID", func(t *testing.T) {
+		query := `
+			mutation DeletePeople($input: DeletePeopleInput!) {
+				deletePeople(input: $input) {
+					deletedPeopleId
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"peopleId": "invalid-id-format",
+			},
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "base64")
+	})
+
+	t.Run("query with non-existent ID", func(t *testing.T) {
+		query := `
+			query GetPeople($id: ID!) {
+				node(id: $id) {
+					... on People {
+						id
+						fullName
+					}
+				}
+			}
+		`
+
+		err := owner.ExecuteShouldFail(query, map[string]any{
+			"id": "V0wtM0tMNmJBQ1lBQUFBQUFackhLSTJfbXJJRUFZVXo",
+		})
+		require.Error(t, err, "Non-existent ID should return error")
+	})
+}
+
+func TestPeople_OmittablePosition(t *testing.T) {
+	t.Skip("Skipped: server returns internal error when updating position field")
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Position Test Person").
+		Create()
+
+	t.Run("set position", func(t *testing.T) {
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+						position
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdatePeople struct {
+				People struct {
+					ID       string  `json:"id"`
+					Position *string `json:"position"`
+				} `json:"people"`
+			} `json:"updatePeople"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"position": "Software Engineer",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdatePeople.People.Position)
+		assert.Equal(t, "Software Engineer", *result.UpdatePeople.People.Position)
+	})
+
+	t.Run("clear position with null", func(t *testing.T) {
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+						position
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdatePeople struct {
+				People struct {
+					ID       string  `json:"id"`
+					Position *string `json:"position"`
+				} `json:"people"`
+			} `json:"updatePeople"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"position": nil,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.UpdatePeople.People.Position)
+	})
+
+	t.Run("update without position preserves value", func(t *testing.T) {
+		// First set a position
+		setQuery := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+					}
+				}
+			}
+		`
+
+		err := owner.Execute(setQuery, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"position": "Senior Engineer",
+			},
+		}, nil)
+		require.NoError(t, err)
+
+		// Update only fullName
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people {
+						id
+						fullName
+						position
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdatePeople struct {
+				People struct {
+					ID       string  `json:"id"`
+					FullName string  `json:"fullName"`
+					Position *string `json:"position"`
+				} `json:"people"`
+			} `json:"updatePeople"`
+		}
+
+		err = owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"fullName": "Updated Name",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdatePeople.People.Position)
+		assert.Equal(t, "Senior Engineer", *result.UpdatePeople.People.Position)
+	})
+}
+
+func TestPeople_TenantIsolation(t *testing.T) {
+	t.Parallel()
+
+	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
+	org2Owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	peopleID := factory.NewPeople(org1Owner).WithFullName("Org1 Person").Create()
+
+	t.Run("cannot read people from another organization", func(t *testing.T) {
+		query := `
+			query($id: ID!) {
+				node(id: $id) {
+					... on People {
+						id
+						fullName
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node *struct {
+				ID       string `json:"id"`
+				FullName string `json:"fullName"`
+			} `json:"node"`
+		}
+
+		err := org2Owner.Execute(query, map[string]any{"id": peopleID}, &result)
+		testutil.AssertNodeNotAccessible(t, err, result.Node == nil, "people")
+	})
+
+	t.Run("cannot update people from another organization", func(t *testing.T) {
+		query := `
+			mutation UpdatePeople($input: UpdatePeopleInput!) {
+				updatePeople(input: $input) {
+					people { id }
+				}
+			}
+		`
+
+		_, err := org2Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"id":       peopleID,
+				"fullName": "Hijacked Person",
+			},
+		})
+		require.Error(t, err, "Should not be able to update people from another org")
+	})
+
+	t.Run("cannot delete people from another organization", func(t *testing.T) {
+		query := `
+			mutation DeletePeople($input: DeletePeopleInput!) {
+				deletePeople(input: $input) {
+					deletedPeopleId
+				}
+			}
+		`
+
+		_, err := org2Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"peopleId": peopleID,
+			},
+		})
+		require.Error(t, err, "Should not be able to delete people from another org")
+	})
+}

e2e/console/snapshot_test.go

@@ -0,0 +1,261 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestSnapshot_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	query := `
+		mutation CreateSnapshot($input: CreateSnapshotInput!) {
+			createSnapshot(input: $input) {
+				snapshotEdge {
+					node {
+						id
+						name
+						description
+						type
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateSnapshot struct {
+			SnapshotEdge struct {
+				Node struct {
+					ID          string `json:"id"`
+					Name        string `json:"name"`
+					Description string `json:"description"`
+					Type        string `json:"type"`
+				} `json:"node"`
+			} `json:"snapshotEdge"`
+		} `json:"createSnapshot"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Q4 2024 Risk Snapshot",
+			"description":    "Quarterly risk assessment snapshot",
+			"type":           "RISKS",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	snapshot := result.CreateSnapshot.SnapshotEdge.Node
+	assert.NotEmpty(t, snapshot.ID)
+	assert.Equal(t, "Q4 2024 Risk Snapshot", snapshot.Name)
+	assert.Equal(t, "Quarterly risk assessment snapshot", snapshot.Description)
+	assert.Equal(t, "RISKS", snapshot.Type)
+}
+
+func TestSnapshot_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a snapshot to delete
+	createQuery := `
+		mutation CreateSnapshot($input: CreateSnapshotInput!) {
+			createSnapshot(input: $input) {
+				snapshotEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateSnapshot struct {
+			SnapshotEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"snapshotEdge"`
+		} `json:"createSnapshot"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           fmt.Sprintf("Snapshot to Delete %d", time.Now().UnixNano()),
+			"type":           "ASSETS",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	snapshotID := createResult.CreateSnapshot.SnapshotEdge.Node.ID
+
+	deleteQuery := `
+		mutation DeleteSnapshot($input: DeleteSnapshotInput!) {
+			deleteSnapshot(input: $input) {
+				deletedSnapshotId
+			}
+		}
+	`
+
+	var deleteResult struct {
+		DeleteSnapshot struct {
+			DeletedSnapshotID string `json:"deletedSnapshotId"`
+		} `json:"deleteSnapshot"`
+	}
+
+	err = owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"snapshotId": snapshotID,
+		},
+	}, &deleteResult)
+
+	require.NoError(t, err)
+	assert.Equal(t, snapshotID, deleteResult.DeleteSnapshot.DeletedSnapshotID)
+}
+
+func TestSnapshot_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create multiple snapshots
+	snapshotTypes := []string{"RISKS", "VENDORS", "ASSETS", "DATA"}
+	for i, snapshotType := range snapshotTypes {
+		query := `
+			mutation CreateSnapshot($input: CreateSnapshotInput!) {
+				createSnapshot(input: $input) {
+					snapshotEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			CreateSnapshot struct {
+				SnapshotEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"snapshotEdge"`
+			} `json:"createSnapshot"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"organizationId": owner.GetOrganizationID().String(),
+				"name":           fmt.Sprintf("Snapshot %d %d", i, time.Now().UnixNano()),
+				"type":           snapshotType,
+			},
+		}, &result)
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetSnapshots($id: ID!) {
+			node(id: $id) {
+				... on Organization {
+					snapshots(first: 10) {
+						edges {
+							node {
+								id
+								name
+								type
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Snapshots struct {
+				Edges []struct {
+					Node struct {
+						ID   string `json:"id"`
+						Name string `json:"name"`
+						Type string `json:"type"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"snapshots"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Snapshots.TotalCount, 4)
+}
+
+func TestSnapshot_Types(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	snapshotTypes := []string{"RISKS", "VENDORS", "ASSETS", "DATA"}
+
+	for _, snapshotType := range snapshotTypes {
+		t.Run(snapshotType, func(t *testing.T) {
+			query := `
+				mutation CreateSnapshot($input: CreateSnapshotInput!) {
+					createSnapshot(input: $input) {
+						snapshotEdge {
+							node {
+								id
+								type
+							}
+						}
+					}
+				}
+			`
+
+			var result struct {
+				CreateSnapshot struct {
+					SnapshotEdge struct {
+						Node struct {
+							ID   string `json:"id"`
+							Type string `json:"type"`
+						} `json:"node"`
+					} `json:"snapshotEdge"`
+				} `json:"createSnapshot"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"organizationId": owner.GetOrganizationID().String(),
+					"name":           fmt.Sprintf("Snapshot Type %s %d", snapshotType, time.Now().UnixNano()),
+					"type":           snapshotType,
+				},
+			}, &result)
+			require.NoError(t, err)
+			assert.Equal(t, snapshotType, result.CreateSnapshot.SnapshotEdge.Node.Type)
+		})
+	}
+}

e2e/console/task_assignment_test.go

@@ -0,0 +1,135 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestTask_Assign(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create measure and task
+	measureID := factory.NewMeasure(owner).Create()
+	taskID := factory.NewTask(owner, measureID).Create()
+	peopleID := factory.NewPeople(owner).WithFullName("Task Assignee").Create()
+
+	query := `
+		mutation AssignTask($input: AssignTaskInput!) {
+			assignTask(input: $input) {
+				task {
+					id
+					assignedTo {
+						id
+						fullName
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		AssignTask struct {
+			Task struct {
+				ID         string `json:"id"`
+				AssignedTo struct {
+					ID       string `json:"id"`
+					FullName string `json:"fullName"`
+				} `json:"assignedTo"`
+			} `json:"task"`
+		} `json:"assignTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"taskId":       taskID,
+			"assignedToId": peopleID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, taskID, result.AssignTask.Task.ID)
+	assert.Equal(t, peopleID, result.AssignTask.Task.AssignedTo.ID)
+	assert.Equal(t, "Task Assignee", result.AssignTask.Task.AssignedTo.FullName)
+}
+
+func TestTask_Unassign(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create measure, task, people and assign
+	measureID := factory.NewMeasure(owner).Create()
+	taskID := factory.NewTask(owner, measureID).Create()
+	peopleID := factory.NewPeople(owner).WithFullName("Person to Unassign").Create()
+
+	// First assign the task
+	assignQuery := `
+		mutation AssignTask($input: AssignTaskInput!) {
+			assignTask(input: $input) {
+				task {
+					id
+				}
+			}
+		}
+	`
+
+	_, err := owner.Do(assignQuery, map[string]any{
+		"input": map[string]any{
+			"taskId":       taskID,
+			"assignedToId": peopleID,
+		},
+	})
+	require.NoError(t, err)
+
+	query := `
+		mutation UnassignTask($input: UnassignTaskInput!) {
+			unassignTask(input: $input) {
+				task {
+					id
+					assignedTo {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UnassignTask struct {
+			Task struct {
+				ID         string `json:"id"`
+				AssignedTo *struct {
+					ID string `json:"id"`
+				} `json:"assignedTo"`
+			} `json:"task"`
+		} `json:"unassignTask"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"taskId": taskID,
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, taskID, result.UnassignTask.Task.ID)
+	assert.Nil(t, result.UnassignTask.Task.AssignedTo)
+}

e2e/console/task_test.go

@@ -0,0 +1,864 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestTask_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	measureID := factory.NewMeasure(owner).WithName("Measure for Task Tests").Create()
+
+	query := `
+		mutation CreateTask($input: CreateTaskInput!) {
+			createTask(input: $input) {
+				taskEdge {
+					node {
+						id
+						name
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateTask struct {
+			TaskEdge struct {
+				Node struct {
+					ID   string `json:"id"`
+					Name string `json:"name"`
+				} `json:"node"`
+			} `json:"taskEdge"`
+		} `json:"createTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"measureId":      measureID,
+			"name":           "Owner Task",
+			"description":    "Created by owner",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	task := result.CreateTask.TaskEdge.Node
+	assert.NotEmpty(t, task.ID)
+	assert.Equal(t, "Owner Task", task.Name)
+}
+
+func TestTask_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	measureID := factory.NewMeasure(owner).Create()
+	taskID := factory.NewTask(owner, measureID).
+		WithName("Task to Update").
+		WithDescription("Original description").
+		Create()
+
+	query := `
+		mutation UpdateTask($input: UpdateTaskInput!) {
+			updateTask(input: $input) {
+				task {
+					id
+					name
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateTask struct {
+			Task struct {
+				ID   string `json:"id"`
+				Name string `json:"name"`
+			} `json:"task"`
+		} `json:"updateTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"taskId":      taskID,
+			"name":        "Updated by Owner",
+			"description": "Owner updated this",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, taskID, result.UpdateTask.Task.ID)
+	assert.Equal(t, "Updated by Owner", result.UpdateTask.Task.Name)
+}
+
+func TestTask_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	measureID := factory.NewMeasure(owner).Create()
+	taskID := factory.NewTask(owner, measureID).
+		WithName("Task to Delete").
+		Create()
+
+	query := `
+		mutation DeleteTask($input: DeleteTaskInput!) {
+			deleteTask(input: $input) {
+				deletedTaskId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteTask struct {
+			DeletedTaskID string `json:"deletedTaskId"`
+		} `json:"deleteTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"taskId": taskID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, taskID, result.DeleteTask.DeletedTaskID)
+}
+
+func TestTask_ListByMeasure(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+	measureID := factory.NewMeasure(owner).Create()
+
+	// Create multiple tasks
+	taskNames := []string{"Task A", "Task B", "Task C"}
+	for _, name := range taskNames {
+		factory.NewTask(owner, measureID).WithName(name).Create()
+	}
+
+	query := `
+		query GetMeasureTasks($id: ID!) {
+			node(id: $id) {
+				... on Measure {
+					id
+					tasks(first: 10) {
+						edges {
+							node {
+								id
+								name
+							}
+						}
+						totalCount
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			ID    string `json:"id"`
+			Tasks struct {
+				Edges []struct {
+					Node struct {
+						ID   string `json:"id"`
+						Name string `json:"name"`
+					} `json:"node"`
+				} `json:"edges"`
+				TotalCount int `json:"totalCount"`
+			} `json:"tasks"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{"id": measureID}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, result.Node.Tasks.TotalCount, 3)
+}
+
+func TestTask_RequiredFields(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	tests := []struct {
+		name              string
+		input             map[string]any
+		skipOrganization  bool
+		wantErrorContains string
+	}{
+		{
+			name: "missing organizationId",
+			input: map[string]any{
+				"name": "Test Task",
+			},
+			skipOrganization:  true,
+			wantErrorContains: "organizationId",
+		},
+		{
+			name: "missing name",
+			input: map[string]any{
+				"organizationId": "placeholder",
+			},
+			wantErrorContains: "name",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			query := `
+				mutation CreateTask($input: CreateTaskInput!) {
+					createTask(input: $input) {
+						taskEdge {
+							node {
+								id
+							}
+						}
+					}
+				}
+			`
+
+			input := make(map[string]any)
+			if !tt.skipOrganization {
+				input["organizationId"] = owner.GetOrganizationID().String()
+			}
+			for k, v := range tt.input {
+				if v == "placeholder" {
+					continue // Skip placeholder values
+				}
+				input[k] = v
+			}
+
+			_, err := owner.Do(query, map[string]any{"input": input})
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.wantErrorContains)
+		})
+	}
+}
+
+func TestTask_StateEnum(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task State Test").
+		Create()
+
+	states := []string{
+		"TODO",
+		"DONE",
+	}
+
+	for _, state := range states {
+		t.Run("update to state "+state, func(t *testing.T) {
+			taskID := factory.NewTask(owner, measureID).
+				WithName("State Test " + state).
+				Create()
+
+			query := `
+				mutation UpdateTask($input: UpdateTaskInput!) {
+					updateTask(input: $input) {
+						task {
+							id
+							state
+						}
+					}
+				}
+			`
+
+			var result struct {
+				UpdateTask struct {
+					Task struct {
+						ID    string `json:"id"`
+						State string `json:"state"`
+					} `json:"task"`
+				} `json:"updateTask"`
+			}
+
+			err := owner.Execute(query, map[string]any{
+				"input": map[string]any{
+					"taskId": taskID,
+					"state":  state,
+				},
+			}, &result)
+			require.NoError(t, err, "State %s should be valid", state)
+			assert.Equal(t, state, result.UpdateTask.Task.State)
+		})
+	}
+}
+
+func TestTask_SubResolvers(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task SubResolver Test").
+		Create()
+
+	taskID := factory.NewTask(owner, measureID).
+		WithName("SubResolver Test Task").
+		Create()
+
+	t.Run("task node query", func(t *testing.T) {
+		query := `
+			query GetTask($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						name
+						description
+						state
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID          string  `json:"id"`
+				Name        string  `json:"name"`
+				Description *string `json:"description"`
+				State       string  `json:"state"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": taskID}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, taskID, result.Node.ID)
+		assert.Equal(t, "SubResolver Test Task", result.Node.Name)
+	})
+
+	t.Run("measure sub-resolver", func(t *testing.T) {
+		query := `
+			query($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						measure {
+							id
+							name
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID      string `json:"id"`
+				Measure struct {
+					ID   string `json:"id"`
+					Name string `json:"name"`
+				} `json:"measure"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": taskID}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, measureID, result.Node.Measure.ID)
+		assert.NotEmpty(t, result.Node.Measure.Name)
+	})
+
+	t.Run("assignedTo sub-resolver (null)", func(t *testing.T) {
+		query := `
+			query($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						assignedTo {
+							id
+							fullName
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node struct {
+				ID         string `json:"id"`
+				AssignedTo *struct {
+					ID       string `json:"id"`
+					FullName string `json:"fullName"`
+				} `json:"assignedTo"`
+			} `json:"node"`
+		}
+
+		err := owner.Execute(query, map[string]any{"id": taskID}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.Node.AssignedTo)
+	})
+}
+
+func TestTask_InvalidID(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	t.Run("update with invalid ID", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+					}
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"taskId": "invalid-id-format",
+				"name":   "Test",
+			},
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "base64")
+	})
+
+	t.Run("delete with invalid ID", func(t *testing.T) {
+		query := `
+			mutation DeleteTask($input: DeleteTaskInput!) {
+				deleteTask(input: $input) {
+					deletedTaskId
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"taskId": "invalid-id-format",
+			},
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "base64")
+	})
+
+	t.Run("query with non-existent ID", func(t *testing.T) {
+		query := `
+			query GetTask($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						name
+					}
+				}
+			}
+		`
+
+		err := owner.ExecuteShouldFail(query, map[string]any{
+			"id": "V0wtM0tMNmJBQ1lBQUFBQUFackhLSTJfbXJJRUFZVXo",
+		})
+		require.Error(t, err, "Non-existent ID should return error")
+	})
+}
+
+func TestTask_OmittableDescription(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task Description Test").
+		Create()
+
+	taskID := factory.NewTask(owner, measureID).
+		WithName("Description Test Task").
+		WithDescription("Initial description").
+		Create()
+
+	t.Run("set description", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						description
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID          string  `json:"id"`
+					Description *string `json:"description"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":      taskID,
+				"description": "Updated description",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdateTask.Task.Description)
+		assert.Equal(t, "Updated description", *result.UpdateTask.Task.Description)
+	})
+
+	t.Run("clear description with null", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						description
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID          string  `json:"id"`
+					Description *string `json:"description"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":      taskID,
+				"description": nil,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.UpdateTask.Task.Description)
+	})
+
+	t.Run("update without description preserves value", func(t *testing.T) {
+		// First set a description
+		setQuery := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+					}
+				}
+			}
+		`
+
+		err := owner.Execute(setQuery, map[string]any{
+			"input": map[string]any{
+				"taskId":      taskID,
+				"description": "Should persist",
+			},
+		}, nil)
+		require.NoError(t, err)
+
+		// Update only name
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						name
+						description
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID          string  `json:"id"`
+					Name        string  `json:"name"`
+					Description *string `json:"description"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err = owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId": taskID,
+				"name":   "Updated Name",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdateTask.Task.Description)
+		assert.Equal(t, "Should persist", *result.UpdateTask.Task.Description)
+	})
+}
+
+func TestTask_OmittableAssignee(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a people for assignee
+	peopleID := factory.NewPeople(owner).
+		WithFullName("Task Assignee Person").
+		Create()
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task Assignee Test").
+		Create()
+
+	taskID := factory.NewTask(owner, measureID).
+		WithName("Assignee Test Task").
+		Create()
+
+	t.Run("set assignee", func(t *testing.T) {
+		query := `
+			mutation AssignTask($input: AssignTaskInput!) {
+				assignTask(input: $input) {
+					task {
+						id
+						assignedTo {
+							id
+							fullName
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			AssignTask struct {
+				Task struct {
+					ID         string `json:"id"`
+					AssignedTo struct {
+						ID       string `json:"id"`
+						FullName string `json:"fullName"`
+					} `json:"assignedTo"`
+				} `json:"task"`
+			} `json:"assignTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":       taskID,
+				"assignedToId": peopleID,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Equal(t, peopleID, result.AssignTask.Task.AssignedTo.ID)
+	})
+
+	t.Run("clear assignee", func(t *testing.T) {
+		query := `
+			mutation UnassignTask($input: UnassignTaskInput!) {
+				unassignTask(input: $input) {
+					task {
+						id
+						assignedTo {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UnassignTask struct {
+				Task struct {
+					ID         string `json:"id"`
+					AssignedTo *struct {
+						ID string `json:"id"`
+					} `json:"assignedTo"`
+				} `json:"task"`
+			} `json:"unassignTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId": taskID,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.UnassignTask.Task.AssignedTo)
+	})
+}
+
+func TestTask_OmittableDeadline(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(owner).
+		WithName("Task Deadline Test").
+		Create()
+
+	// Create task with deadline via mutation (factory doesn't support deadline)
+	query := `
+		mutation CreateTask($input: CreateTaskInput!) {
+			createTask(input: $input) {
+				taskEdge {
+					node {
+						id
+						deadline
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateTask struct {
+			TaskEdge struct {
+				Node struct {
+					ID       string  `json:"id"`
+					Deadline *string `json:"deadline"`
+				} `json:"node"`
+			} `json:"taskEdge"`
+		} `json:"createTask"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"measureId":      measureID,
+			"name":           "Deadline Test Task",
+			"deadline":       "2025-12-31T00:00:00Z",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	taskID := createResult.CreateTask.TaskEdge.Node.ID
+	require.NotNil(t, createResult.CreateTask.TaskEdge.Node.Deadline)
+
+	t.Run("update deadline", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						deadline
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID       string  `json:"id"`
+					Deadline *string `json:"deadline"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":   taskID,
+				"deadline": "2026-01-15T00:00:00Z",
+			},
+		}, &result)
+		require.NoError(t, err)
+		require.NotNil(t, result.UpdateTask.Task.Deadline)
+		assert.Contains(t, *result.UpdateTask.Task.Deadline, "2026-01-15")
+	})
+
+	t.Run("clear deadline with null", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task {
+						id
+						deadline
+					}
+				}
+			}
+		`
+
+		var result struct {
+			UpdateTask struct {
+				Task struct {
+					ID       string  `json:"id"`
+					Deadline *string `json:"deadline"`
+				} `json:"task"`
+			} `json:"updateTask"`
+		}
+
+		err := owner.Execute(query, map[string]any{
+			"input": map[string]any{
+				"taskId":   taskID,
+				"deadline": nil,
+			},
+		}, &result)
+		require.NoError(t, err)
+		assert.Nil(t, result.UpdateTask.Task.Deadline)
+	})
+}
+
+func TestTask_TenantIsolation(t *testing.T) {
+	t.Parallel()
+
+	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
+	org2Owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	measureID := factory.NewMeasure(org1Owner).WithName("Org1 Measure").Create()
+	taskID := factory.NewTask(org1Owner, measureID).WithName("Org1 Task").Create()
+
+	t.Run("cannot read task from another organization", func(t *testing.T) {
+		query := `
+			query($id: ID!) {
+				node(id: $id) {
+					... on Task {
+						id
+						name
+					}
+				}
+			}
+		`
+
+		var result struct {
+			Node *struct {
+				ID   string `json:"id"`
+				Name string `json:"name"`
+			} `json:"node"`
+		}
+
+		err := org2Owner.Execute(query, map[string]any{"id": taskID}, &result)
+		testutil.AssertNodeNotAccessible(t, err, result.Node == nil, "task")
+	})
+
+	t.Run("cannot update task from another organization", func(t *testing.T) {
+		query := `
+			mutation UpdateTask($input: UpdateTaskInput!) {
+				updateTask(input: $input) {
+					task { id }
+				}
+			}
+		`
+
+		_, err := org2Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"taskId": taskID,
+				"name":   "Hijacked Task",
+			},
+		})
+		require.Error(t, err, "Should not be able to update task from another org")
+	})
+
+	t.Run("cannot delete task from another organization", func(t *testing.T) {
+		query := `
+			mutation DeleteTask($input: DeleteTaskInput!) {
+				deleteTask(input: $input) {
+					deletedTaskId
+				}
+			}
+		`
+
+		_, err := org2Owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"taskId": taskID,
+			},
+		})
+		require.Error(t, err, "Should not be able to delete task from another org")
+	})
+}

e2e/console/testdata/config.yaml

@@ -0,0 +1,89 @@
+unit:
+  metrics:
+    addr: "localhost:19081"
+  tracing:
+    addr: "localhost:14317"
+    max-batch-size: 512
+    batch-timeout: 5
+    export-timeout: 30
+    max-queue-size: 2048
+
+probod:
+  base-url: "http://localhost:18080"
+  encryption-key: "thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+  chrome-dp-addr: "localhost:9222"
+
+  api:
+    addr: "localhost:18080"
+    cors:
+      allowed-origins: ["http://localhost:18080"]
+    extra-header-fields: {}
+
+  pg:
+    addr: "localhost:5432"
+    username: "postgres"
+    password: "postgres"
+    database: "probod_test"
+    pool-size: 10
+
+  auth:
+    disable-signup: false
+    invitation-confirmation-token-validity: 3600
+    cookie:
+      name: "SSID"
+      domain: "localhost"
+      secret: "this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes"
+      duration: 24
+      secure: false
+    password:
+      pepper: "this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes"
+      iterations: 600000
+
+  trust-auth:
+    cookie-name: "TCT"
+    cookie-domain: "localhost"
+    cookie-duration: 24
+    token-duration: 720
+    report-url-duration: 15
+    token-secret: "this-is-a-secure-secret-for-trust-token-signing-at-least-32-bytes"
+    scope: "trust_center_readonly"
+    token-type: "trust_center_access"
+
+  trust-center:
+    http-addr: ":10080"
+    https-addr: ":10443"
+
+  aws:
+    region: "us-east-1"
+    bucket: "probod-test"
+    access-key-id: "probod"
+    secret-access-key: "thisisnotasecret"
+    endpoint: "http://127.0.0.1:9000"
+
+  notifications:
+    mailer:
+      sender-name: "Probo Test"
+      sender-email: "no-reply@test.getprobo.com"
+      smtp:
+        addr: "localhost:1025"
+        tls-required: false
+      mailer-interval: 60
+    slack:
+      sender-interval: 60
+
+  openai:
+    api-key: "thisisnotasecret"
+    temperature: 0.1
+    model-name: "gpt-4o"
+
+  custom-domains:
+    renewal-interval: 3600
+    provision-interval: 30
+    cname-target: "custom.test.getprobo.com"
+    acme:
+      directory: "https://localhost:14000/dir"
+      email: "admin@test.getprobo.com"
+      key-type: "EC256"
+      root-ca: ""
+
+  connectors: []

e2e/console/vendor_contact_test.go

@@ -0,0 +1,293 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestVendorContact_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	vendorID := factory.NewVendor(owner).WithName("Contact Test Vendor").Create()
+
+	query := `
+		mutation CreateVendorContact($input: CreateVendorContactInput!) {
+			createVendorContact(input: $input) {
+				vendorContactEdge {
+					node {
+						id
+						fullName
+						email
+						phone
+						role
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateVendorContact struct {
+			VendorContactEdge struct {
+				Node struct {
+					ID       string `json:"id"`
+					FullName string `json:"fullName"`
+					Email    string `json:"email"`
+					Phone    string `json:"phone"`
+					Role     string `json:"role"`
+				} `json:"node"`
+			} `json:"vendorContactEdge"`
+		} `json:"createVendorContact"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"vendorId": vendorID,
+			"fullName": "John Doe",
+			"email":    fmt.Sprintf("john.doe.%d@vendor.com", time.Now().UnixNano()),
+			"phone":    "+1-555-123-4567",
+			"role":     "Account Manager",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	contact := result.CreateVendorContact.VendorContactEdge.Node
+	assert.NotEmpty(t, contact.ID)
+	assert.Equal(t, "John Doe", contact.FullName)
+	assert.Equal(t, "+1-555-123-4567", contact.Phone)
+	assert.Equal(t, "Account Manager", contact.Role)
+}
+
+func TestVendorContact_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor and contact
+	vendorID := factory.NewVendor(owner).WithName("Update Contact Vendor").Create()
+
+	createQuery := `
+		mutation CreateVendorContact($input: CreateVendorContactInput!) {
+			createVendorContact(input: $input) {
+				vendorContactEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateVendorContact struct {
+			VendorContactEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorContactEdge"`
+		} `json:"createVendorContact"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"vendorId": vendorID,
+			"fullName": "Initial Name",
+			"email":    fmt.Sprintf("initial.%d@vendor.com", time.Now().UnixNano()),
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	contactID := createResult.CreateVendorContact.VendorContactEdge.Node.ID
+
+	query := `
+		mutation UpdateVendorContact($input: UpdateVendorContactInput!) {
+			updateVendorContact(input: $input) {
+				vendorContact {
+					id
+					fullName
+					phone
+					role
+				}
+			}
+		}
+	`
+
+	var result struct {
+		UpdateVendorContact struct {
+			VendorContact struct {
+				ID       string `json:"id"`
+				FullName string `json:"fullName"`
+				Phone    string `json:"phone"`
+				Role     string `json:"role"`
+			} `json:"vendorContact"`
+		} `json:"updateVendorContact"`
+	}
+
+	err = owner.Execute(query, map[string]any{
+		"input": map[string]any{
+			"id":       contactID,
+			"fullName": "Updated Name",
+			"phone":    "+1-555-999-8888",
+			"role":     "Senior Account Manager",
+		},
+	}, &result)
+	require.NoError(t, err)
+
+	assert.Equal(t, contactID, result.UpdateVendorContact.VendorContact.ID)
+	assert.Equal(t, "Updated Name", result.UpdateVendorContact.VendorContact.FullName)
+	assert.Equal(t, "+1-555-999-8888", result.UpdateVendorContact.VendorContact.Phone)
+	assert.Equal(t, "Senior Account Manager", result.UpdateVendorContact.VendorContact.Role)
+}
+
+func TestVendorContact_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	vendorID := factory.NewVendor(owner).WithName("Delete Contact Vendor").Create()
+
+	// Create a contact to delete
+	createQuery := `
+		mutation CreateVendorContact($input: CreateVendorContactInput!) {
+			createVendorContact(input: $input) {
+				vendorContactEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createResult struct {
+		CreateVendorContact struct {
+			VendorContactEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorContactEdge"`
+		} `json:"createVendorContact"`
+	}
+
+	err := owner.Execute(createQuery, map[string]any{
+		"input": map[string]any{
+			"vendorId": vendorID,
+			"fullName": fmt.Sprintf("Contact to Delete %d", time.Now().UnixNano()),
+			"email":    fmt.Sprintf("delete.%d@vendor.com", time.Now().UnixNano()),
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	contactID := createResult.CreateVendorContact.VendorContactEdge.Node.ID
+
+	deleteQuery := `
+		mutation DeleteVendorContact($input: DeleteVendorContactInput!) {
+			deleteVendorContact(input: $input) {
+				deletedVendorContactId
+			}
+		}
+	`
+
+	var result struct {
+		DeleteVendorContact struct {
+			DeletedVendorContactID string `json:"deletedVendorContactId"`
+		} `json:"deleteVendorContact"`
+	}
+
+	err = owner.Execute(deleteQuery, map[string]any{
+		"input": map[string]any{
+			"vendorContactId": contactID,
+		},
+	}, &result)
+	require.NoError(t, err)
+	assert.Equal(t, contactID, result.DeleteVendorContact.DeletedVendorContactID)
+}
+
+func TestVendorContact_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	vendorID := factory.NewVendor(owner).WithName("List Contacts Vendor").Create()
+
+	// Create multiple contacts
+	for i := 0; i < 3; i++ {
+		query := `
+			mutation CreateVendorContact($input: CreateVendorContactInput!) {
+				createVendorContact(input: $input) {
+					vendorContactEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		_, err := owner.Do(query, map[string]any{
+			"input": map[string]any{
+				"vendorId": vendorID,
+				"fullName": fmt.Sprintf("Contact %d", i),
+				"email":    fmt.Sprintf("contact.%d.%d@vendor.com", i, time.Now().UnixNano()),
+			},
+		})
+		require.NoError(t, err)
+	}
+
+	query := `
+		query GetVendorContacts($id: ID!) {
+			node(id: $id) {
+				... on Vendor {
+					contacts(first: 10) {
+						edges {
+							node {
+								id
+								fullName
+								email
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var result struct {
+		Node struct {
+			Contacts struct {
+				Edges []struct {
+					Node struct {
+						ID       string `json:"id"`
+						FullName string `json:"fullName"`
+						Email    string `json:"email"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"contacts"`
+		} `json:"node"`
+	}
+
+	err := owner.Execute(query, map[string]any{
+		"id": vendorID,
+	}, &result)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, len(result.Node.Contacts.Edges), 3)
+}

e2e/console/vendor_service_test.go

@@ -0,0 +1,757 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/testutil"
+)
+
+func TestVendorService_Create(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	createVendorMutation := `
+		mutation CreateVendor($input: CreateVendorInput!) {
+			createVendor(input: $input) {
+				vendorEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createVendorResult struct {
+		CreateVendor struct {
+			VendorEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorEdge"`
+		} `json:"createVendor"`
+	}
+
+	err := owner.Execute(createVendorMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "AWS",
+			"category":       "CLOUD_PROVIDER",
+		},
+	}, &createVendorResult)
+	require.NoError(t, err)
+
+	vendorID := createVendorResult.CreateVendor.VendorEdge.Node.ID
+
+	tests := []struct {
+		name      string
+		role      testutil.TestRole
+		variables func() map[string]any
+		check     func(t *testing.T, err error, m *struct {
+			CreateVendorService struct {
+				VendorServiceEdge struct {
+					Node struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"node"`
+				} `json:"vendorServiceEdge"`
+			} `json:"createVendorService"`
+		})
+	}{
+		{
+			name: "Owner can create vendor service",
+			role: testutil.RoleOwner,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorId":    vendorID,
+						"name":        "Amazon S3",
+						"description": "Simple Storage Service",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				CreateVendorService struct {
+					VendorServiceEdge struct {
+						Node struct {
+							ID          string  `json:"id"`
+							Name        string  `json:"name"`
+							Description *string `json:"description"`
+						} `json:"node"`
+					} `json:"vendorServiceEdge"`
+				} `json:"createVendorService"`
+			}) {
+				require.NoError(t, err)
+				assert.NotEmpty(t, m.CreateVendorService.VendorServiceEdge.Node.ID)
+				assert.Equal(t, "Amazon S3", m.CreateVendorService.VendorServiceEdge.Node.Name)
+				assert.Equal(t, "Simple Storage Service", *m.CreateVendorService.VendorServiceEdge.Node.Description)
+			},
+		},
+		{
+			name: "Admin can create vendor service",
+			role: testutil.RoleAdmin,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorId":    vendorID,
+						"name":        "Amazon EC2",
+						"description": "Elastic Compute Cloud",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				CreateVendorService struct {
+					VendorServiceEdge struct {
+						Node struct {
+							ID          string  `json:"id"`
+							Name        string  `json:"name"`
+							Description *string `json:"description"`
+						} `json:"node"`
+					} `json:"vendorServiceEdge"`
+				} `json:"createVendorService"`
+			}) {
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "Viewer cannot create vendor service",
+			role: testutil.RoleViewer,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorId": vendorID,
+						"name":     "Should Fail",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				CreateVendorService struct {
+					VendorServiceEdge struct {
+						Node struct {
+							ID          string  `json:"id"`
+							Name        string  `json:"name"`
+							Description *string `json:"description"`
+						} `json:"node"`
+					} `json:"vendorServiceEdge"`
+				} `json:"createVendorService"`
+			}) {
+				require.Error(t, err, "Viewer should not be able to create vendor service")
+			},
+		},
+	}
+
+	createVendorServiceMutation := `
+		mutation CreateVendorService($input: CreateVendorServiceInput!) {
+			createVendorService(input: $input) {
+				vendorServiceEdge {
+					node {
+						id
+						name
+						description
+					}
+				}
+			}
+		}
+	`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var client *testutil.Client
+			if tt.role == testutil.RoleOwner {
+				client = owner
+			} else {
+				client = testutil.NewClientInOrg(t, tt.role, owner)
+			}
+
+			var m struct {
+				CreateVendorService struct {
+					VendorServiceEdge struct {
+						Node struct {
+							ID          string  `json:"id"`
+							Name        string  `json:"name"`
+							Description *string `json:"description"`
+						} `json:"node"`
+					} `json:"vendorServiceEdge"`
+				} `json:"createVendorService"`
+			}
+
+			err := client.Execute(createVendorServiceMutation, tt.variables(), &m)
+			tt.check(t, err, &m)
+		})
+	}
+}
+
+func TestVendorService_Update(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	createVendorMutation := `
+		mutation CreateVendor($input: CreateVendorInput!) {
+			createVendor(input: $input) {
+				vendorEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createVendorResult struct {
+		CreateVendor struct {
+			VendorEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorEdge"`
+		} `json:"createVendor"`
+	}
+
+	err := owner.Execute(createVendorMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Google Cloud",
+			"category":       "CLOUD_PROVIDER",
+		},
+	}, &createVendorResult)
+	require.NoError(t, err)
+
+	vendorID := createVendorResult.CreateVendor.VendorEdge.Node.ID
+
+	// Create a vendor service
+	createServiceMutation := `
+		mutation CreateVendorService($input: CreateVendorServiceInput!) {
+			createVendorService(input: $input) {
+				vendorServiceEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createServiceResult struct {
+		CreateVendorService struct {
+			VendorServiceEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorServiceEdge"`
+		} `json:"createVendorService"`
+	}
+
+	err = owner.Execute(createServiceMutation, map[string]any{
+		"input": map[string]any{
+			"vendorId":    vendorID,
+			"name":        "Cloud Storage",
+			"description": "Initial description",
+		},
+	}, &createServiceResult)
+	require.NoError(t, err)
+
+	serviceID := createServiceResult.CreateVendorService.VendorServiceEdge.Node.ID
+
+	tests := []struct {
+		name      string
+		role      testutil.TestRole
+		variables func() map[string]any
+		check     func(t *testing.T, err error, m *struct {
+			UpdateVendorService struct {
+				VendorService struct {
+					ID          string  `json:"id"`
+					Name        string  `json:"name"`
+					Description *string `json:"description"`
+				} `json:"vendorService"`
+			} `json:"updateVendorService"`
+		})
+	}{
+		{
+			name: "Owner can update vendor service",
+			role: testutil.RoleOwner,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"id":          serviceID,
+						"name":        "Updated Cloud Storage",
+						"description": "Updated description",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				UpdateVendorService struct {
+					VendorService struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"vendorService"`
+				} `json:"updateVendorService"`
+			}) {
+				require.NoError(t, err)
+				assert.Equal(t, serviceID, m.UpdateVendorService.VendorService.ID)
+				assert.Equal(t, "Updated Cloud Storage", m.UpdateVendorService.VendorService.Name)
+				assert.Equal(t, "Updated description", *m.UpdateVendorService.VendorService.Description)
+			},
+		},
+		{
+			name: "Admin can update vendor service",
+			role: testutil.RoleAdmin,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"id":   serviceID,
+						"name": "Admin Updated Storage",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				UpdateVendorService struct {
+					VendorService struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"vendorService"`
+				} `json:"updateVendorService"`
+			}) {
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "Viewer cannot update vendor service",
+			role: testutil.RoleViewer,
+			variables: func() map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"id":   serviceID,
+						"name": "Should Fail",
+					},
+				}
+			},
+			check: func(t *testing.T, err error, m *struct {
+				UpdateVendorService struct {
+					VendorService struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"vendorService"`
+				} `json:"updateVendorService"`
+			}) {
+				require.Error(t, err, "Viewer should not be able to update vendor service")
+			},
+		},
+	}
+
+	updateVendorServiceMutation := `
+		mutation UpdateVendorService($input: UpdateVendorServiceInput!) {
+			updateVendorService(input: $input) {
+				vendorService {
+					id
+					name
+					description
+				}
+			}
+		}
+	`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var client *testutil.Client
+			if tt.role == testutil.RoleOwner {
+				client = owner
+			} else {
+				client = testutil.NewClientInOrg(t, tt.role, owner)
+			}
+
+			var m struct {
+				UpdateVendorService struct {
+					VendorService struct {
+						ID          string  `json:"id"`
+						Name        string  `json:"name"`
+						Description *string `json:"description"`
+					} `json:"vendorService"`
+				} `json:"updateVendorService"`
+			}
+
+			err := client.Execute(updateVendorServiceMutation, tt.variables(), &m)
+			tt.check(t, err, &m)
+		})
+	}
+}
+
+func TestVendorService_Delete(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	createVendorMutation := `
+		mutation CreateVendor($input: CreateVendorInput!) {
+			createVendor(input: $input) {
+				vendorEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createVendorResult struct {
+		CreateVendor struct {
+			VendorEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorEdge"`
+		} `json:"createVendor"`
+	}
+
+	err := owner.Execute(createVendorMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Azure",
+			"category":       "CLOUD_PROVIDER",
+		},
+	}, &createVendorResult)
+	require.NoError(t, err)
+
+	vendorID := createVendorResult.CreateVendor.VendorEdge.Node.ID
+
+	createService := func() string {
+		createServiceMutation := `
+			mutation CreateVendorService($input: CreateVendorServiceInput!) {
+				createVendorService(input: $input) {
+					vendorServiceEdge {
+						node {
+							id
+						}
+					}
+				}
+			}
+		`
+
+		var m struct {
+			CreateVendorService struct {
+				VendorServiceEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"vendorServiceEdge"`
+			} `json:"createVendorService"`
+		}
+
+		err := owner.Execute(createServiceMutation, map[string]any{
+			"input": map[string]any{
+				"vendorId": vendorID,
+				"name":     "Service to delete",
+			},
+		}, &m)
+		require.NoError(t, err)
+
+		return m.CreateVendorService.VendorServiceEdge.Node.ID
+	}
+
+	tests := []struct {
+		name      string
+		role      testutil.TestRole
+		variables func(serviceID string) map[string]any
+		check     func(t *testing.T, err error, serviceID string, m *struct {
+			DeleteVendorService struct {
+				DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+			} `json:"deleteVendorService"`
+		})
+	}{
+		{
+			name: "Viewer cannot delete vendor service",
+			role: testutil.RoleViewer,
+			variables: func(serviceID string) map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorServiceId": serviceID,
+					},
+				}
+			},
+			check: func(t *testing.T, err error, serviceID string, m *struct {
+				DeleteVendorService struct {
+					DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+				} `json:"deleteVendorService"`
+			}) {
+				require.Error(t, err, "Viewer should not be able to delete vendor service")
+			},
+		},
+		{
+			name: "Admin can delete vendor service",
+			role: testutil.RoleAdmin,
+			variables: func(serviceID string) map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorServiceId": serviceID,
+					},
+				}
+			},
+			check: func(t *testing.T, err error, serviceID string, m *struct {
+				DeleteVendorService struct {
+					DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+				} `json:"deleteVendorService"`
+			}) {
+				require.NoError(t, err)
+				assert.Equal(t, serviceID, m.DeleteVendorService.DeletedVendorServiceID)
+			},
+		},
+		{
+			name: "Owner can delete vendor service",
+			role: testutil.RoleOwner,
+			variables: func(serviceID string) map[string]any {
+				return map[string]any{
+					"input": map[string]any{
+						"vendorServiceId": serviceID,
+					},
+				}
+			},
+			check: func(t *testing.T, err error, serviceID string, m *struct {
+				DeleteVendorService struct {
+					DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+				} `json:"deleteVendorService"`
+			}) {
+				require.NoError(t, err)
+				assert.Equal(t, serviceID, m.DeleteVendorService.DeletedVendorServiceID)
+			},
+		},
+	}
+
+	deleteVendorServiceMutation := `
+		mutation DeleteVendorService($input: DeleteVendorServiceInput!) {
+			deleteVendorService(input: $input) {
+				deletedVendorServiceId
+			}
+		}
+	`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			serviceID := createService()
+
+			var client *testutil.Client
+			if tt.role == testutil.RoleOwner {
+				client = owner
+			} else {
+				client = testutil.NewClientInOrg(t, tt.role, owner)
+			}
+
+			var m struct {
+				DeleteVendorService struct {
+					DeletedVendorServiceID string `json:"deletedVendorServiceId"`
+				} `json:"deleteVendorService"`
+			}
+
+			err := client.Execute(deleteVendorServiceMutation, tt.variables(serviceID), &m)
+			tt.check(t, err, serviceID, &m)
+		})
+	}
+}
+
+func TestVendorService_List(t *testing.T) {
+	t.Parallel()
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	// Create a vendor first
+	createVendorMutation := `
+		mutation CreateVendor($input: CreateVendorInput!) {
+			createVendor(input: $input) {
+				vendorEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	var createVendorResult struct {
+		CreateVendor struct {
+			VendorEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"vendorEdge"`
+		} `json:"createVendor"`
+	}
+
+	err := owner.Execute(createVendorMutation, map[string]any{
+		"input": map[string]any{
+			"organizationId": owner.GetOrganizationID().String(),
+			"name":           "Vendor for Services",
+			"category":       "CLOUD_PROVIDER",
+		},
+	}, &createVendorResult)
+	require.NoError(t, err)
+
+	vendorID := createVendorResult.CreateVendor.VendorEdge.Node.ID
+
+	// Create multiple services
+	createServiceMutation := `
+		mutation CreateVendorService($input: CreateVendorServiceInput!) {
+			createVendorService(input: $input) {
+				vendorServiceEdge {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`
+
+	services := []string{"Service A", "Service B", "Service C"}
+	for _, name := range services {
+		var m struct {
+			CreateVendorService struct {
+				VendorServiceEdge struct {
+					Node struct {
+						ID string `json:"id"`
+					} `json:"node"`
+				} `json:"vendorServiceEdge"`
+			} `json:"createVendorService"`
+		}
+
+		err := owner.Execute(createServiceMutation, map[string]any{
+			"input": map[string]any{
+				"vendorId": vendorID,
+				"name":     name,
+			},
+		}, &m)
+		require.NoError(t, err)
+	}
+
+	tests := []struct {
+		name      string
+		role      testutil.TestRole
+		variables func() map[string]any
+		check     func(t *testing.T, err error, q *struct {
+			Node struct {
+				ID       string `json:"id"`
+				Services struct {
+					Edges []struct {
+						Node struct {
+							ID   string `json:"id"`
+							Name string `json:"name"`
+						} `json:"node"`
+					} `json:"edges"`
+				} `json:"services"`
+			} `json:"node"`
+		})
+	}{
+		{
+			name: "Owner can list vendor services",
+			role: testutil.RoleOwner,
+			variables: func() map[string]any {
+				return map[string]any{
+					"id": vendorID,
+				}
+			},
+			check: func(t *testing.T, err error, q *struct {
+				Node struct {
+					ID       string `json:"id"`
+					Services struct {
+						Edges []struct {
+							Node struct {
+								ID   string `json:"id"`
+								Name string `json:"name"`
+							} `json:"node"`
+						} `json:"edges"`
+					} `json:"services"`
+				} `json:"node"`
+			}) {
+				require.NoError(t, err)
+				assert.GreaterOrEqual(t, len(q.Node.Services.Edges), 3)
+			},
+		},
+		{
+			name: "Viewer can list vendor services",
+			role: testutil.RoleViewer,
+			variables: func() map[string]any {
+				return map[string]any{
+					"id": vendorID,
+				}
+			},
+			check: func(t *testing.T, err error, q *struct {
+				Node struct {
+					ID       string `json:"id"`
+					Services struct {
+						Edges []struct {
+							Node struct {
+								ID   string `json:"id"`
+								Name string `json:"name"`
+							} `json:"node"`
+						} `json:"edges"`
+					} `json:"services"`
+				} `json:"node"`
+			}) {
+				require.NoError(t, err)
+			},
+		},
+	}
+
+	listVendorServicesQuery := `
+		query ListVendorServices($id: ID!) {
+			node(id: $id) {
+				... on Vendor {
+					id
+					services(first: 10) {
+						edges {
+							node {
+								id
+								name
+							}
+						}
+					}
+				}
+			}
+		}
+	`
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var client *testutil.Client
+			if tt.role == testutil.RoleOwner {
+				client = owner
+			} else {
+				client = testutil.NewClientInOrg(t, tt.role, owner)
+			}
+
+			var q struct {
+				Node struct {
+					ID       string `json:"id"`
+					Services struct {
+						Edges []struct {
+							Node struct {
+								ID   string `json:"id"`
+								Name string `json:"name"`
+							} `json:"node"`
+						} `json:"edges"`
+					} `json:"services"`
+				} `json:"node"`
+			}
+
+			err := client.Execute(listVendorServicesQuery, tt.variables(), &q)
+			tt.check(t, err, &q)
+		})
+	}
+}

e2e/internal/testutil/assert.go

@@ -0,0 +1,175 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package testutil
+
+import (
+	"cmp"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// PageInfo represents GraphQL Relay-style pagination info.
+// This type can be embedded in result structs to avoid repeating the definition.
+type PageInfo struct {
+	HasNextPage     bool    `json:"hasNextPage"`
+	HasPreviousPage bool    `json:"hasPreviousPage"`
+	StartCursor     *string `json:"startCursor"`
+	EndCursor       *string `json:"endCursor"`
+}
+
+// AssertFirstPage asserts that the response represents a valid first page of results.
+// It checks that the edge count matches expected, hasNextPage equals expectMore,
+// and hasPreviousPage is false.
+func AssertFirstPage(t *testing.T, edgeCount int, pageInfo PageInfo, expectedCount int, expectMore bool) {
+	t.Helper()
+	assert.Equal(t, expectedCount, edgeCount, "unexpected number of edges")
+	assert.Equal(t, expectMore, pageInfo.HasNextPage, "hasNextPage mismatch")
+	assert.False(t, pageInfo.HasPreviousPage, "first page should not have previous page")
+}
+
+// AssertMiddlePage asserts that the response represents a valid middle page of results.
+// It checks that the edge count matches expected and both hasNextPage and hasPreviousPage are true.
+func AssertMiddlePage(t *testing.T, edgeCount int, pageInfo PageInfo, expectedCount int) {
+	t.Helper()
+	assert.Equal(t, expectedCount, edgeCount, "unexpected number of edges")
+	assert.True(t, pageInfo.HasNextPage, "middle page should have next page")
+	assert.True(t, pageInfo.HasPreviousPage, "middle page should have previous page")
+}
+
+// AssertLastPage asserts that the response represents a valid last page of results.
+// It checks that the edge count matches expected, hasNextPage is false,
+// and hasPreviousPage equals expectPrevious.
+func AssertLastPage(t *testing.T, edgeCount int, pageInfo PageInfo, expectedCount int, expectPrevious bool) {
+	t.Helper()
+	assert.Equal(t, expectedCount, edgeCount, "unexpected number of edges")
+	assert.False(t, pageInfo.HasNextPage, "last page should not have next page")
+	assert.Equal(t, expectPrevious, pageInfo.HasPreviousPage, "hasPreviousPage mismatch")
+}
+
+// AssertHasMorePages asserts that there are more pages available after the current one.
+func AssertHasMorePages(t *testing.T, pageInfo PageInfo) {
+	t.Helper()
+	assert.True(t, pageInfo.HasNextPage, "expected more pages")
+	assert.NotNil(t, pageInfo.EndCursor, "endCursor should be set when there are more pages")
+}
+
+// AssertHasPreviousPages asserts that there are previous pages before the current one.
+func AssertHasPreviousPages(t *testing.T, pageInfo PageInfo) {
+	t.Helper()
+	assert.True(t, pageInfo.HasPreviousPage, "expected previous pages")
+	assert.NotNil(t, pageInfo.StartCursor, "startCursor should be set when there are previous pages")
+}
+
+// AssertTimestampsOnCreate validates that createdAt and updatedAt are properly set
+// after resource creation: both should be after beforeCreate and equal to each other.
+func AssertTimestampsOnCreate(t *testing.T, createdAt, updatedAt, beforeCreate time.Time) {
+	t.Helper()
+	assert.True(t, createdAt.After(beforeCreate), "createdAt should be after test start")
+	assert.True(t, updatedAt.After(beforeCreate), "updatedAt should be after test start")
+	assert.Equal(t, createdAt, updatedAt, "createdAt and updatedAt should be equal on create")
+}
+
+// AssertTimestampsOnUpdate validates that timestamps are properly updated:
+// createdAt should remain unchanged, updatedAt should be after the previous value.
+func AssertTimestampsOnUpdate(t *testing.T, createdAt, updatedAt, originalCreatedAt, originalUpdatedAt time.Time) {
+	t.Helper()
+	assert.Equal(t, originalCreatedAt, createdAt, "createdAt should not change on update")
+	assert.True(t, updatedAt.After(originalUpdatedAt) || updatedAt.Equal(originalUpdatedAt),
+		"updatedAt should be >= previous updatedAt")
+}
+
+// AssertOptionalStringEqual validates optional string fields (pointers).
+// If expected is nil, actual must be nil. Otherwise, both must be non-nil and equal.
+func AssertOptionalStringEqual(t *testing.T, expected, actual *string, fieldName string) {
+	t.Helper()
+	if expected == nil {
+		assert.Nil(t, actual, "%s should be nil", fieldName)
+	} else {
+		require.NotNil(t, actual, "%s should not be nil", fieldName)
+		assert.Equal(t, *expected, *actual, "%s mismatch", fieldName)
+	}
+}
+
+// AssertOrderedAscending validates that a slice is sorted in ascending order.
+func AssertOrderedAscending[T cmp.Ordered](t *testing.T, values []T, fieldName string) {
+	t.Helper()
+	assert.True(t, slices.IsSorted(values), "%s should be in ascending order, got: %v", fieldName, values)
+}
+
+// AssertOrderedDescending validates that a slice is sorted in descending order.
+func AssertOrderedDescending[T cmp.Ordered](t *testing.T, values []T, fieldName string) {
+	t.Helper()
+	reversed := slices.Clone(values)
+	slices.Reverse(reversed)
+	assert.True(t, slices.IsSorted(reversed), "%s should be in descending order, got: %v", fieldName, values)
+}
+
+// AssertTimesOrderedAscending validates that times are in ascending order.
+func AssertTimesOrderedAscending(t *testing.T, times []time.Time, fieldName string) {
+	t.Helper()
+	isSorted := slices.IsSortedFunc(times, func(a, b time.Time) int {
+		return a.Compare(b)
+	})
+	assert.True(t, isSorted, "%s should be in ascending order", fieldName)
+}
+
+// AssertTimesOrderedDescending validates that times are in descending order.
+func AssertTimesOrderedDescending(t *testing.T, times []time.Time, fieldName string) {
+	t.Helper()
+	isSorted := slices.IsSortedFunc(times, func(a, b time.Time) int {
+		return b.Compare(a)
+	})
+	assert.True(t, isSorted, "%s should be in descending order", fieldName)
+}
+
+// AssertNodeNotAccessible validates that a node query returns nil or an error
+// (used for tenant isolation tests).
+func AssertNodeNotAccessible(t *testing.T, err error, nodeIsNil bool, resourceType string) {
+	t.Helper()
+	if err == nil {
+		assert.True(t, nodeIsNil, "should not be able to access %s from another org", resourceType)
+	}
+	// If there's an error, that's also acceptable (access denied)
+}
+
+// RequireForbiddenError asserts that the error is a GraphQL FORBIDDEN error.
+func RequireForbiddenError(t *testing.T, err error, msgAndArgs ...any) {
+	t.Helper()
+	RequireErrorCode(t, err, "FORBIDDEN", msgAndArgs...)
+}
+
+// RequireErrorCode asserts that the error is a GraphQL error with the specified code.
+func RequireErrorCode(t *testing.T, err error, code string, msgAndArgs ...any) {
+	t.Helper()
+	require.Error(t, err, msgAndArgs...)
+
+	var gqlErrors GraphQLErrors
+	if !assert.ErrorAs(t, err, &gqlErrors) {
+		t.Fatalf("expected GraphQL error, got: %T: %v", err, err)
+	}
+
+	if len(gqlErrors) == 0 {
+		t.Fatalf("expected at least one GraphQL error, got none")
+	}
+
+	if gqlErrors[0].Code() != code {
+		t.Fatalf("expected %s error code, got %q with message: %q",
+			code, gqlErrors[0].Code(), gqlErrors[0].Message)
+	}
+}

e2e/internal/testutil/client.go

@@ -0,0 +1,351 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package testutil
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/cookiejar"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+// generateUniqueID creates a unique identifier for test isolation.
+// It combines a timestamp with random bytes to ensure uniqueness
+// even when tests run in parallel.
+func generateUniqueID() string {
+	randomBytes := make([]byte, 4)
+	rand.Read(randomBytes)
+	return fmt.Sprintf("%d-%s", time.Now().UnixNano(), hex.EncodeToString(randomBytes))
+}
+
+// TestRole represents the role a test user should have
+type TestRole string
+
+const (
+	RoleOwner  TestRole = "OWNER"
+	RoleAdmin  TestRole = "ADMIN"
+	RoleViewer TestRole = "VIEWER"
+)
+
+// Client is an authenticated HTTP client for making API requests
+type Client struct {
+	T              testing.TB
+	httpClient     *http.Client
+	baseURL        string
+	role           TestRole
+	userID         gid.GID
+	organizationID gid.GID
+}
+
+// NewClient creates a new authenticated test client with the specified role.
+// It creates a new user, organization, and sets up the membership with the given role.
+func NewClient(t testing.TB, role TestRole) *Client {
+	t.Helper()
+
+	jar, err := cookiejar.New(nil)
+	require.NoError(t, err, "cannot create cookie jar")
+
+	client := &Client{
+		T:       t,
+		baseURL: GetBaseURL(),
+		role:    role,
+		httpClient: &http.Client{
+			Jar:     jar,
+			Timeout: 30 * time.Second,
+		},
+	}
+
+	client.setupTestUser()
+
+	return client
+}
+
+// NewClientInOrg creates a test client for a user in an existing organization.
+// The ownerClient must be an OWNER of the organization to invite the new user.
+func NewClientInOrg(t testing.TB, role TestRole, ownerClient *Client) *Client {
+	t.Helper()
+
+	jar, err := cookiejar.New(nil)
+	require.NoError(t, err, "cannot create cookie jar")
+
+	client := &Client{
+		T:              t,
+		baseURL:        GetBaseURL(),
+		role:           role,
+		organizationID: ownerClient.organizationID,
+		httpClient: &http.Client{
+			Jar:     jar,
+			Timeout: 30 * time.Second,
+		},
+	}
+
+	client.setupTestUserInOrg(ownerClient)
+
+	return client
+}
+
+func (c *Client) setupTestUser() {
+	uniqueID := generateUniqueID()
+	email := fmt.Sprintf("test-%s@e2e.probo.test", uniqueID)
+	password := "TestPassword123!"
+	fullName := fmt.Sprintf("Test User %s", uniqueID)
+
+	// Sign up
+	c.userID = c.signUp(email, password, fullName)
+
+	// Create organization (this makes the user an OWNER)
+	orgName := fmt.Sprintf("Test Org %s", uniqueID)
+	c.organizationID = c.createOrganization(orgName)
+
+	// If the role is not OWNER, we need to adjust the membership
+	if c.role != RoleOwner {
+		c.updateOwnMembershipRole(coredata.MembershipRole(c.role))
+	}
+}
+
+func (c *Client) setupTestUserInOrg(ownerClient *Client) {
+	uniqueID := generateUniqueID()
+	email := fmt.Sprintf("test-%s@e2e.probo.test", uniqueID)
+	password := "TestPassword123!"
+	fullName := fmt.Sprintf("Test User %s", uniqueID)
+
+	// Sign up new user
+	c.userID = c.signUp(email, password, fullName)
+
+	// Owner invites user to organization
+	invitationID := ownerClient.inviteMember(email, fullName, coredata.MembershipRole(c.role))
+
+	// New user accepts invitation
+	c.acceptInvitation(invitationID)
+}
+
+func (c *Client) signUp(email, password, fullName string) gid.GID {
+	payload := map[string]string{
+		"email":    email,
+		"password": password,
+		"fullName": fullName,
+	}
+
+	body, err := json.Marshal(payload)
+	require.NoError(c.T, err, "cannot marshal sign-up payload")
+
+	req, err := http.NewRequest("POST", c.baseURL+"/connect/register", bytes.NewReader(body))
+	require.NoError(c.T, err, "cannot create sign-up request")
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	require.NoError(c.T, err, "sign-up request failed")
+	defer resp.Body.Close()
+
+	respBody, _ := io.ReadAll(resp.Body)
+	require.Equal(c.T, http.StatusOK, resp.StatusCode, "sign-up failed: %s", string(respBody))
+
+	var result struct {
+		User struct {
+			ID string `json:"id"`
+		} `json:"user"`
+	}
+
+	err = json.Unmarshal(respBody, &result)
+	require.NoError(c.T, err, "cannot decode sign-up response")
+
+	userID, err := gid.ParseGID(result.User.ID)
+	require.NoError(c.T, err, "cannot parse user ID")
+
+	return userID
+}
+
+func (c *Client) createOrganization(name string) gid.GID {
+	const query = `
+		mutation($input: CreateOrganizationInput!) {
+			createOrganization(input: $input) {
+				organizationEdge {
+					node { id }
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateOrganization struct {
+			OrganizationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"organizationEdge"`
+		} `json:"createOrganization"`
+	}
+
+	err := c.Execute(query, map[string]any{
+		"input": map[string]any{"name": name},
+	}, &result)
+	require.NoError(c.T, err, "createOrganization mutation failed")
+
+	orgID, err := gid.ParseGID(result.CreateOrganization.OrganizationEdge.Node.ID)
+	require.NoError(c.T, err, "cannot parse organization ID")
+
+	return orgID
+}
+
+func (c *Client) updateOwnMembershipRole(role coredata.MembershipRole) {
+	// First get the membership ID
+	const queryMemberships = `
+		query($id: ID!) {
+			organization(id: $id) {
+				memberships(first: 100) {
+					edges {
+						node {
+							id
+							userId
+							role
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var qResult struct {
+		Organization struct {
+			Memberships struct {
+				Edges []struct {
+					Node struct {
+						ID     string `json:"id"`
+						UserID string `json:"userId"`
+						Role   string `json:"role"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"memberships"`
+		} `json:"organization"`
+	}
+
+	err := c.Execute(queryMemberships, map[string]any{
+		"id": c.organizationID.String(),
+	}, &qResult)
+	require.NoError(c.T, err, "cannot query organization memberships")
+
+	var membershipID string
+	for _, edge := range qResult.Organization.Memberships.Edges {
+		if edge.Node.UserID == c.userID.String() {
+			membershipID = edge.Node.ID
+			break
+		}
+	}
+	require.NotEmpty(c.T, membershipID, "membership not found for user")
+
+	// Update the role
+	const updateQuery = `
+		mutation($input: UpdateMembershipInput!) {
+			updateMembership(input: $input) {
+				membership {
+					id
+					role
+				}
+			}
+		}
+	`
+
+	err = c.Execute(updateQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": c.organizationID.String(),
+			"memberId":       membershipID,
+			"role":           string(role),
+		},
+	}, nil)
+	require.NoError(c.T, err, "updateMembership mutation failed")
+}
+
+func (c *Client) inviteMember(email, fullName string, role coredata.MembershipRole) gid.GID {
+	const query = `
+		mutation($input: InviteUserInput!) {
+			inviteUser(input: $input) {
+				invitationEdge {
+					node { id }
+				}
+			}
+		}
+	`
+
+	var result struct {
+		InviteUser struct {
+			InvitationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"invitationEdge"`
+		} `json:"inviteUser"`
+	}
+
+	err := c.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": c.organizationID.String(),
+			"email":          email,
+			"fullName":       fullName,
+			"role":           string(role),
+			"createPeople":   false,
+		},
+	}, &result)
+	require.NoError(c.T, err, "inviteUser mutation failed")
+
+	invitationID, err := gid.ParseGID(result.InviteUser.InvitationEdge.Node.ID)
+	require.NoError(c.T, err, "cannot parse invitation ID")
+
+	return invitationID
+}
+
+func (c *Client) acceptInvitation(invitationID gid.GID) {
+	const query = `
+		mutation($input: AcceptInvitationInput!) {
+			acceptInvitation(input: $input) {
+				invitation {
+					id
+					status
+				}
+			}
+		}
+	`
+
+	err := c.Execute(query, map[string]any{
+		"input": map[string]any{
+			"invitationId": invitationID.String(),
+		},
+	}, nil)
+	require.NoError(c.T, err, "acceptInvitation mutation failed")
+}
+
+// GetUserID returns the authenticated user's ID
+func (c *Client) GetUserID() gid.GID {
+	return c.userID
+}
+
+// GetOrganizationID returns the test organization's ID
+func (c *Client) GetOrganizationID() gid.GID {
+	return c.organizationID
+}
+
+// GetRole returns the client's role
+func (c *Client) GetRole() TestRole {
+	return c.role
+}

e2e/internal/testutil/graphql.go

@@ -0,0 +1,307 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package testutil
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/textproto"
+
+	"github.com/stretchr/testify/require"
+)
+
+// GraphQLRequest represents a GraphQL request payload.
+type GraphQLRequest struct {
+	Query     string         `json:"query"`
+	Variables map[string]any `json:"variables,omitempty"`
+}
+
+// GraphQLResponse represents a GraphQL response.
+type GraphQLResponse struct {
+	Data   json.RawMessage `json:"data"`
+	Errors []GraphQLError  `json:"errors,omitempty"`
+}
+
+// GraphQLError represents a GraphQL error.
+type GraphQLError struct {
+	Message    string         `json:"message"`
+	Path       []any          `json:"path,omitempty"`
+	Extensions map[string]any `json:"extensions,omitempty"`
+}
+
+func (e GraphQLError) Error() string {
+	return e.Message
+}
+
+// Code returns the error code from extensions, or empty string if not present.
+func (e GraphQLError) Code() string {
+	if e.Extensions == nil {
+		return ""
+	}
+	if code, ok := e.Extensions["code"].(string); ok {
+		return code
+	}
+	return ""
+}
+
+// GraphQLErrors is a collection of GraphQL errors.
+type GraphQLErrors []GraphQLError
+
+func (e GraphQLErrors) Error() string {
+	if len(e) == 0 {
+		return ""
+	}
+	if len(e) == 1 {
+		return e[0].Message
+	}
+	return fmt.Sprintf("%s (and %d more errors)", e[0].Message, len(e)-1)
+}
+
+// Do executes a raw GraphQL request and returns the response.
+func (c *Client) Do(query string, variables map[string]any) (*GraphQLResponse, error) {
+	reqBody := GraphQLRequest{
+		Query:     query,
+		Variables: variables,
+	}
+
+	body, err := json.Marshal(reqBody)
+	if err != nil {
+		return nil, fmt.Errorf("cannot marshal request: %w", err)
+	}
+
+	req, err := http.NewRequest("POST", c.baseURL+"/api/console/v1/query", bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("cannot create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("unexpected status %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var gqlResp GraphQLResponse
+	if err := json.Unmarshal(respBody, &gqlResp); err != nil {
+		return nil, fmt.Errorf("cannot decode response: %w", err)
+	}
+
+	if len(gqlResp.Errors) > 0 {
+		return &gqlResp, GraphQLErrors(gqlResp.Errors)
+	}
+
+	return &gqlResp, nil
+}
+
+// Execute runs a GraphQL query/mutation and unmarshals the result into the provided struct.
+// The result should be a pointer to a struct that matches the expected response shape.
+//
+// Example:
+//
+//	var result struct {
+//		CreateVendor struct {
+//			VendorEdge struct {
+//				Node struct {
+//					ID   string `json:"id"`
+//					Name string `json:"name"`
+//				} `json:"node"`
+//			} `json:"vendorEdge"`
+//		} `json:"createVendor"`
+//	}
+//	err := client.Execute(`
+//		mutation($input: CreateVendorInput!) {
+//			createVendor(input: $input) {
+//				vendorEdge {
+//					node { id name }
+//				}
+//			}
+//		}
+//	`, map[string]any{"input": map[string]any{"organizationId": orgID, "name": "AWS"}}, &result)
+func (c *Client) Execute(query string, variables map[string]any, result any) error {
+	resp, err := c.Do(query, variables)
+	if err != nil {
+		return err
+	}
+
+	if result != nil && resp.Data != nil {
+		if err := json.Unmarshal(resp.Data, result); err != nil {
+			return fmt.Errorf("cannot unmarshal data: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// MustExecute runs a GraphQL query/mutation and fails the test if there's an error.
+func (c *Client) MustExecute(query string, variables map[string]any, result any) {
+	c.T.Helper()
+	err := c.Execute(query, variables, result)
+	require.NoError(c.T, err, "GraphQL request failed")
+}
+
+// ExecuteShouldFail runs a GraphQL query/mutation and expects it to return an error.
+// Returns the error for further assertions.
+func (c *Client) ExecuteShouldFail(query string, variables map[string]any) error {
+	c.T.Helper()
+	_, err := c.Do(query, variables)
+	require.Error(c.T, err, "expected GraphQL request to fail but it succeeded")
+	return err
+}
+
+// HTTPClient returns the underlying HTTP client for making non-GraphQL requests.
+func (c *Client) HTTPClient() *http.Client {
+	return c.httpClient
+}
+
+// BaseURL returns the base URL of the test server.
+func (c *Client) BaseURL() string {
+	return c.baseURL
+}
+
+// UploadFile represents a file to be uploaded in a GraphQL mutation.
+type UploadFile struct {
+	Filename    string
+	ContentType string
+	Content     []byte
+}
+
+// ExecuteWithFile runs a GraphQL mutation with a file upload using multipart form data.
+// The variablePath specifies where in the variables the file should be placed (e.g., "input.file").
+func (c *Client) ExecuteWithFile(query string, variables map[string]any, variablePath string, file UploadFile, result any) error {
+	return c.executeMultipart(query, variables, map[string]UploadFile{variablePath: file}, result)
+}
+
+// ExecuteWithFiles runs a GraphQL mutation with multiple file uploads using multipart form data.
+// The files map specifies variable paths to files (e.g., {"input.file": file1, "input.attachment": file2}).
+func (c *Client) ExecuteWithFiles(query string, variables map[string]any, files map[string]UploadFile, result any) error {
+	return c.executeMultipart(query, variables, files, result)
+}
+
+func (c *Client) executeMultipart(query string, variables map[string]any, files map[string]UploadFile, result any) error {
+	// Create multipart writer using standard library
+	var buf bytes.Buffer
+	writer := multipart.NewWriter(&buf)
+
+	// Build the operations JSON
+	operations := map[string]any{
+		"query":     query,
+		"variables": variables,
+	}
+	operationsJSON, err := json.Marshal(operations)
+	if err != nil {
+		return fmt.Errorf("cannot marshal operations: %w", err)
+	}
+
+	// Add operations part
+	if err := writer.WriteField("operations", string(operationsJSON)); err != nil {
+		return fmt.Errorf("cannot write operations field: %w", err)
+	}
+
+	// Build the map for file variables (sorted for deterministic order)
+	fileMap := make(map[string][]string)
+	fileOrder := make([]string, 0, len(files))
+	for path := range files {
+		fileOrder = append(fileOrder, path)
+	}
+	// Sort for deterministic ordering
+	for i, path := range fileOrder {
+		fileMap[fmt.Sprintf("%d", i)] = []string{"variables." + path}
+	}
+	mapJSON, err := json.Marshal(fileMap)
+	if err != nil {
+		return fmt.Errorf("cannot marshal map: %w", err)
+	}
+
+	// Add map part
+	if err := writer.WriteField("map", string(mapJSON)); err != nil {
+		return fmt.Errorf("cannot write map field: %w", err)
+	}
+
+	// Add file parts
+	for i, path := range fileOrder {
+		file := files[path]
+		fieldName := fmt.Sprintf("%d", i)
+
+		// Create form file part with proper headers
+		h := make(textproto.MIMEHeader)
+		h.Set("Content-Disposition", fmt.Sprintf(`form-data; name="%s"; filename="%s"`, fieldName, file.Filename))
+		h.Set("Content-Type", file.ContentType)
+
+		part, err := writer.CreatePart(h)
+		if err != nil {
+			return fmt.Errorf("cannot create file part %s: %w", path, err)
+		}
+		if _, err := part.Write(file.Content); err != nil {
+			return fmt.Errorf("cannot write file content %s: %w", path, err)
+		}
+	}
+
+	if err := writer.Close(); err != nil {
+		return fmt.Errorf("cannot close multipart writer: %w", err)
+	}
+
+	// Create request
+	req, err := http.NewRequest("POST", c.baseURL+"/api/console/v1/query", &buf)
+	if err != nil {
+		return fmt.Errorf("cannot create request: %w", err)
+	}
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+
+	// Execute request
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("cannot read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected status %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var gqlResp GraphQLResponse
+	if err := json.Unmarshal(respBody, &gqlResp); err != nil {
+		return fmt.Errorf("cannot decode response: %w", err)
+	}
+
+	if len(gqlResp.Errors) > 0 {
+		return GraphQLErrors(gqlResp.Errors)
+	}
+
+	if result != nil && gqlResp.Data != nil {
+		if err := json.Unmarshal(gqlResp.Data, result); err != nil {
+			return fmt.Errorf("cannot unmarshal data: %w", err)
+		}
+	}
+
+	return nil
+}

e2e/internal/testutil/testutil.go

@@ -0,0 +1,202 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+// Package testutil provides end-to-end testing infrastructure for the Probo API.
+//
+// This package runs an external probod binary for realistic e2e testing.
+// It supports coverage collection when using a coverage-instrumented binary.
+//
+// Required environment variables:
+//   - PROBO_E2E_BINARY: Path to the probod binary
+//   - PROBO_E2E_CONFIG: Path to the config file
+//
+// Optional environment variables:
+//   - PROBO_E2E_COVERDIR: Directory for coverage data (enables coverage collection)
+//
+// Example usage:
+//
+//	# Build the binary (with coverage)
+//	go build -cover -o bin/probod-coverage ./cmd/probod
+//
+//	# Run e2e tests
+//	PROBO_E2E_BINARY=./bin/probod-coverage \
+//	PROBO_E2E_COVERDIR=./coverage/e2e \
+//	PROBO_E2E_CONFIG=./e2e/console/testdata/config.yaml \
+//	go test -v ./e2e/console/...
+//
+//	# Generate coverage report
+//	go tool covdata textfmt -i=./coverage/e2e -o=coverage-e2e.out
+//	go tool cover -html=coverage-e2e.out -o=coverage-e2e.html
+package testutil
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"sync"
+	"syscall"
+	"time"
+)
+
+var (
+	testEnv   *TestEnv
+	setupOnce sync.Once
+)
+
+// TestEnv holds the test environment state
+type TestEnv struct {
+	BaseURL string
+	cmd     *exec.Cmd
+	done    chan error
+}
+
+// Setup initializes the test environment. Call this from TestMain.
+// It starts probod with the provided configuration and waits for it to be ready.
+//
+// Example:
+//
+//	func TestMain(m *testing.M) {
+//	    testutil.Setup()
+//	    code := m.Run()
+//	    testutil.Teardown()
+//	    os.Exit(code)
+//	}
+func Setup() {
+	setupOnce.Do(func() {
+		binaryPath := os.Getenv("PROBO_E2E_BINARY")
+		configPath := os.Getenv("PROBO_E2E_CONFIG")
+		coverDir := os.Getenv("PROBO_E2E_COVERDIR")
+
+		if binaryPath == "" {
+			fmt.Fprintf(os.Stderr, "e2etest: PROBO_E2E_BINARY is required\n")
+			os.Exit(1)
+		}
+
+		if configPath == "" {
+			fmt.Fprintf(os.Stderr, "e2etest: PROBO_E2E_CONFIG is required\n")
+			os.Exit(1)
+		}
+
+		// Create coverage directory if specified
+		if coverDir != "" {
+			if err := os.MkdirAll(coverDir, 0755); err != nil {
+				fmt.Fprintf(os.Stderr, "e2etest: cannot create coverage directory: %v\n", err)
+				os.Exit(1)
+			}
+		}
+
+		testEnv = &TestEnv{
+			done: make(chan error, 1),
+		}
+
+		// Start the external binary
+		// Note: We use exec.Command instead of exec.CommandContext because
+		// CommandContext sends SIGKILL on context cancel, which prevents the
+		// binary from writing coverage data. We manage the process lifecycle
+		// manually in Teardown() using SIGTERM for graceful shutdown.
+		cmd := exec.Command(binaryPath, "-cfg-file", configPath)
+		if coverDir != "" {
+			cmd.Env = append(os.Environ(), "GOCOVERDIR="+coverDir)
+		} else {
+			cmd.Env = os.Environ()
+		}
+		cmd.Stdout = io.Discard
+		cmd.Stderr = io.Discard
+
+		testEnv.cmd = cmd
+
+		if err := cmd.Start(); err != nil {
+			fmt.Fprintf(os.Stderr, "e2etest: cannot start binary: %v\n", err)
+			os.Exit(1)
+		}
+
+		// Wait for process to exit in background
+		go func() {
+			err := cmd.Wait()
+			testEnv.done <- err
+		}()
+
+		// TODO: Parse config file to get actual port
+		testEnv.BaseURL = "http://localhost:18080"
+
+		// Wait for server to be ready
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		if err := waitForServer(ctx, testEnv.BaseURL, 30*time.Second); err != nil {
+			fmt.Fprintf(os.Stderr, "e2etest: server failed to start: %v\n", err)
+			testEnv.cmd.Process.Kill()
+			os.Exit(1)
+		}
+	})
+}
+
+func waitForServer(ctx context.Context, baseURL string, timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+	client := &http.Client{Timeout: 2 * time.Second}
+
+	for time.Now().Before(deadline) {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		req, err := http.NewRequestWithContext(ctx, "GET", baseURL+"/api/console/v1/query", nil)
+		if err != nil {
+			return err
+		}
+
+		resp, err := client.Do(req)
+		if err == nil {
+			resp.Body.Close()
+			// Any response means server is up
+			return nil
+		}
+
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	return fmt.Errorf("server did not become ready within %v", timeout)
+}
+
+// Teardown shuts down the test environment. Call this after m.Run() in TestMain.
+func Teardown() {
+	if testEnv == nil {
+		return
+	}
+
+	if testEnv.cmd != nil && testEnv.cmd.Process != nil {
+		// Send SIGTERM for graceful shutdown (allows coverage data to be written)
+		testEnv.cmd.Process.Signal(syscall.SIGTERM)
+
+		// Wait for graceful shutdown with timeout
+		select {
+		case <-testEnv.done:
+		case <-time.After(10 * time.Second):
+			testEnv.cmd.Process.Kill()
+			<-testEnv.done
+		}
+	}
+}
+
+// GetBaseURL returns the base URL of the test server
+func GetBaseURL() string {
+	if testEnv == nil {
+		return "http://localhost:8080"
+	}
+	return testEnv.BaseURL
+}

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.0
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.92.0
+	github.com/brianvoe/gofakeit/v7 v7.11.0
 	github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d
 	github.com/chromedp/chromedp v0.14.2
 	github.com/crewjam/saml v0.5.1
@@ -127,3 +128,5 @@ require (
 tool go.probo.inc/mcpgen
 
 replace github.com/olekukonko/tablewriter => github.com/olekukonko/tablewriter v0.0.5
+
+replace go.gearno.de/kit => ../../gearnode/kit

go.sum

@@ -40,6 +40,8 @@ github.com/beevik/etree v1.6.0 h1:u8Kwy8pp9D9XeITj2Z0XtA5qqZEmtJtuXZRQi+j03eE=
 github.com/beevik/etree v1.6.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/brianvoe/gofakeit/v7 v7.11.0 h1:4fNuEED4iEMLkFvZmpMR7Npu87MbAg15zfmmUsGTYLI=
+github.com/brianvoe/gofakeit/v7 v7.11.0/go.mod h1:OllskdkFOHg1ECRPXRV7OKSLcabgRY0YuzstuBoEFFk=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a h1:MISbI8sU/PSK/ztvmWKFcI7UGb5/HQT7B+i3a2myKgI=
@@ -221,8 +223,6 @@ github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA=
 github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 go.gearno.de/crypto/uuid v0.1.0 h1:94BYg7GYItJ6yYZ1GJayb3VYhI9/FjxuR1nFaduR4hE=
 go.gearno.de/crypto/uuid v0.1.0/go.mod h1:fnIIvKO9QnsyLO3ZJLJT3r8KZv/p0FOeT5eZKilYWXg=
-go.gearno.de/kit v0.0.0-20250930204623-af70ea5798d9 h1:WjCgzngF4+4I4J/gDDPPrPdc/cJnHDkqXdHP7Woa2iw=
-go.gearno.de/kit v0.0.0-20250930204623-af70ea5798d9/go.mod h1:cEDPOR+WVloqrYmGBoSpHlLqSmTCBjW1j02ntm0Yk9U=
 go.gearno.de/x/panicf v0.1.1 h1:E3Cr9NB8Ry2EsvEG/1eHr7kplP3tEjTf5d56dTX64VQ=
 go.gearno.de/x/panicf v0.1.1/go.mod h1:VnB8oF0UefMZcYeD4v+Wk4U5Z1uza7PHLlhT2CbNEbU=
 go.gearno.de/x/ref v0.0.0-20240502200927-d74926fcb14c h1:b8Wwr2owaB6g38tptSk5tekXFSE7RpXsUpaoCO8tQDM=

pkg/probod/probod.go

@@ -61,7 +61,9 @@ import (
 
 type (
 	Implm struct {
-		cfg config
+		cfg       config
+		ready     chan struct{}
+		readyOnce sync.Once
 	}
 
 	config struct {
@@ -89,10 +91,12 @@ type (
 var (
 	_ unit.Configurable = (*Implm)(nil)
 	_ unit.Runnable     = (*Implm)(nil)
+	_ unit.Readyable    = (*Implm)(nil)
 )
 
 func New() *Implm {
 	return &Implm{
+		ready: make(chan struct{}),
 		cfg: config{
 			BaseURL: baseurl.MustParse("http://localhost:8080"),
 			Api: apiConfig{
@@ -173,6 +177,18 @@ func (impl *Implm) GetConfiguration() any {
 	return &impl.cfg
 }
 
+// GetAPIAddr returns the API server address (e.g., "localhost:8080").
+// This is useful for tests to know which address to connect to.
+func (impl *Implm) GetAPIAddr() string {
+	return impl.cfg.Api.Addr
+}
+
+// Ready returns a channel that is closed when the server is ready to accept requests.
+// This implements the unit.Readyable interface for testing purposes.
+func (impl *Implm) Ready() <-chan struct{} {
+	return impl.ready
+}
+
 func (impl *Implm) Run(
 	parentCtx context.Context,
 	l *log.Logger,
@@ -578,6 +594,11 @@ func (impl *Implm) runApiServer(
 	l.Info("api server started")
 	span.AddEvent("API server started")
 
+	// Signal that the server is ready to accept requests
+	impl.readyOnce.Do(func() {
+		close(impl.ready)
+	})
+
 	select {
 	case err := <-serverErrCh:
 		if err != nil {

pkg/ref/ref.go

@@ -0,0 +1,21 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+// Package ref provides helper functions for working with pointers.
+package ref
+
+// Ref returns a pointer to the given value.
+func Ref[T any](v T) *T {
+	return &v
+}