完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/tests/unit/routes/workflow.permissions.test.js

@@ -4,10 +4,21 @@ describe("Workflow Route Permissions", () => {
   const {
     buildWorkflowEntityVisibilityWhere,
     canViewWorkflowEntityType,
+    employeeHasBusinessApproveRole,
     listAllowedActionsForTask,
     parseTaskListQuery,
   } = workflowRoutes.__testables;
 
+  it.each(["admin", "system_admin"])(
+    "does not treat %s as a business approval role even with broad runtime permissions",
+    (roleCode) => {
+      expect(employeeHasBusinessApproveRole({
+        roleCodes: [roleCode],
+        permissionCodes: ["*", "expense.approve"],
+      }, "reimbursement")).toBe(false);
+    },
+  );
+
   it("allows leave approvers to act on leave tasks", () => {
     const actions = listAllowedActionsForTask(
       { employee: { permissionCodes: ["leave.approve"] } },