test(acceptance): beoordeling scenario asserts the workflow task is completed (refs #13)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/architecture/adr-0013-behandel-portal-wiring.md

@@ -0,0 +1,76 @@
+# ADR-0013: Behandel-portal wiring — multi-realm BFF auth, werkbak from Flowable tasks, decision completes the task
+
+- **Status:** Accepted
+- **Date:** 2026-07-15
+- **Deciders:** Respellion engineering
+- **Relates to:** #84 (adr-proposal), S-12 (#13); builds on ADR-0010 (BFF OIDC), ADR-0011 (approval status flow), ADR-0009 (external-task worker), ADR-0008 (read projection)
+
+## Context
+
+S-12 adds the behandel-portal: a behandelaar logs in, sees a **werkbak** of registrations awaiting
+beoordeling, and decides each (goedkeuren/afwijzen). Three questions had no obvious answer and shape
+the whole slice.
+
+1. **Which realm authenticates behandelaars, and how does the BFF accept it?** Citizens use the
+   `digid` realm (ADR-0010); staff use a separate `medewerker` realm with roles (`behandelaar`,
+   `teamlead`). Keycloak realms are distinct issuers with distinct signing keys, so the BFF's single
+   `digid`-realm JWT validation rejects a medewerker token outright.
+2. **Where does the werkbak get its data?** The registrations awaiting beoordeling could come from
+   the read projection (status-filtered rows) or from the Flowable `Beoordelen` user tasks (S-12b).
+3. **How does a decision correlate to the workflow?** The process parks at the `Beoordelen` user
+   task; the decision must advance it, and also apply the domain transition (ADR-0011).
+
+## Decision
+
+**The BFF validates a second realm for behandel endpoints; the werkbak is the set of open Flowable
+`Beoordelen` tasks (read through the domain); and a decision both applies the domain transition and
+completes the Flowable task.**
+
+- **Multi-realm BFF auth.** The BFF registers a second JWT bearer scheme (`medewerker`, authority =
+  the medewerker realm) alongside the default `digid` scheme. `/behandel/*` endpoints require an
+  authorization policy bound to the `medewerker` scheme **and** the `behandelaar` role. Keycloak puts
+  realm roles in the nested `realm_access.roles` claim, which ASP.NET does not map automatically, so
+  the scheme's `OnTokenValidated` lifts those roles onto the principal as role claims. Self-service
+  keeps the `digid` scheme. Audience validation stays off (ADR-0010's deferred hardening).
+- **Werkbak = Flowable user tasks (via the domain).** The domain's `Werkbak` query reads the open
+  `Beoordelen` tasks from the Workflow Client (§8.2, `IUserTaskClient`) and enriches each with its
+  aggregate's bsn + status; `GET /behandel/werkbak` exposes it and the BFF proxies it behind the
+  behandelaar policy. The list **is** the authoritative set of claimable/decidable work items, so a
+  decision acts on a real task with no separate correlation store. The read projection stays the
+  anonymous openbaar model — we do **not** project `IN_BEHANDELING` or populate staff-only personal
+  data (both deferred in ADR-0008) just to render a staff view.
+- **Decision completes the task (S-12c-2).** A behandelaar decision applies the domain transition
+  (aggregate + ACL for approval, per ADR-0011) **and** completes the Flowable `Beoordelen` task
+  (looked up by registrationId), so the process advances. Implemented in the next sub-slice; recorded
+  here so the boundary is decided up front.
+
+Delivery is split: **S-12c-1** (this PR) = multi-realm auth + werkbak read; **S-12c-2** = the decide
+endpoint + task completion.
+
+## Consequences
+
+**Positive**
+
+- Staff and citizens are cleanly separated by realm; the `behandelaar` role gates the behandel API.
+- The werkbak reflects exactly what a behandelaar can act on; claim/decide need no extra correlation.
+- No premature projection changes — the openbaar read model stays focused and personal-data-free.
+- Only the ACL/Workflow Client talk to their peers; the BFF still fans out only to domain/projection
+  (§8.3).
+
+**Negative / costs**
+
+- The BFF now depends on two Keycloak realms being reachable (`Keycloak:MedewerkerAuthority`).
+- Rendering the werkbak fans out to Flowable (one task query) plus a store read per task — acceptable
+  for the caseload sizes here; a denormalized staff read model is an additive follow-up if needed.
+- Realm separation (distinct issuers/keys) is validated live, not in the BFF unit tests, where issuer
+  validation is off and one test key signs both realms; the tests exercise the role-based authorization.
+
+## Alternatives considered
+
+- **Werkbak from the read projection** — rejected for now: needs new plumbing to project
+  `IN_BEHANDELING` and to populate staff-only bsn/naam (deferred, ADR-0008), plus a separate way to
+  find the Flowable task at decide-time. Revisit if a high-volume denormalized staff view is needed.
+- **One JWT scheme accepting both realms (issuer validation off)** — rejected: trusting multiple
+  issuers without validation is a security regression; two schemes keep each realm's issuer/key checked.
+- **A dedicated behandel BFF/service** — rejected as premature; one BFF with per-endpoint policies is
+  enough at this size and keeps §8.3 simple.

infra/docker-compose.yml

@@ -349,6 +349,8 @@ services:
       # Keycloak (start-dev) derives the issuer from the request host, so the BFF authority and the
       # verify token request both use keycloak:8080 to keep the issuer consistent.
       Keycloak__Authority: http://keycloak:8080/realms/digid
+      # Behandelaars authenticate against the medewerker realm; the BFF validates it for /behandel/* (S-12c).
+      Keycloak__MedewerkerAuthority: http://keycloak:8080/realms/medewerker
       Downstream__Domain__BaseUrl: http://domain:8080/
       Downstream__Projection__BaseUrl: http://projection-api:8080/
     ports:

libs/api-client/src/lib/generated/bff-api.ts

@@ -24,6 +24,10 @@ import {
   Observable
 } from 'rxjs';
 
+export interface DecideRequest {
+  besluit: string;
+}
+
 export interface OpenbaarEntry {
   id: string;
   status: string;
@@ -36,6 +40,12 @@ export interface SubmitAccepted {
   status: string;
 }
 
+export interface WerkbakItem {
+  registrationId: string;
+  bsn: string;
+  status: string;
+}
+
 export type GetOpenbaarRegisterParams = {
 q?: string;
 };
@@ -215,4 +225,73 @@ export class BffApiV1Service {
     );
   }
 
+ getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientBodyOptions): Observable<TData>;
+ getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
+ getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
+  getBehandelWerkbak<TData = WerkbakItem[]>(
+     options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
+    if (options?.observe === 'events') {
+      return this.http.get<TData>(
+      `/behandel/werkbak`,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'events',
+      }
+    );
+    }
+
+    if (options?.observe === 'response') {
+      return this.http.get<TData>(
+      `/behandel/werkbak`,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'response',
+      }
+    );
+    }
+
+    return this.http.get<TData>(
+      `/behandel/werkbak`,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'body',
+      }
+    );
+  }
+
+ postBehandelRegistrationsIdDecide<TData = void>(id: string,
+    decideRequest: DecideRequest, options?: HttpClientBodyOptions): Observable<TData>;
+ postBehandelRegistrationsIdDecide<TData = void>(id: string,
+    decideRequest: DecideRequest, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
+ postBehandelRegistrationsIdDecide<TData = void>(id: string,
+    decideRequest: DecideRequest, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
+  postBehandelRegistrationsIdDecide<TData = void>(
+    id: string,
+    decideRequest: DecideRequest, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
+    if (options?.observe === 'events') {
+      return this.http.post<TData>(
+      `/behandel/registrations/${id}/decide`,
+      decideRequest,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'events',
+      }
+    );
+    }
+
+    if (options?.observe === 'response') {
+      return this.http.post<TData>(
+      `/behandel/registrations/${id}/decide`,
+      decideRequest,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'response',
+      }
+    );
+    }
+
+    return this.http.post<TData>(
+      `/behandel/registrations/${id}/decide`,
+      decideRequest,{
+        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
+        observe: 'body',
+      }
+    );
+  }
+
 };

services/bff/Bff.Api/DownstreamClients.cs

@@ -13,10 +13,20 @@ public sealed record ProjectionEntry(string Id, string Status, string? Reference
 /// <summary>A public-safe openbaar register row — only non-sensitive fields leave the BFF.</summary>
 public sealed record OpenbaarEntry(string Id, string Status, string? Reference);
 
+/// <summary>A behandelaar's werkbak row: a registration awaiting beoordeling, with the bsn + status a
+/// behandelaar sees (staff view — reached only behind medewerker/behandelaar authorization, S-12c).</summary>
+public sealed record WerkbakItem(string RegistrationId, string Bsn, string Status);
+
 /// <summary>Port to the Domain Service (§8.3: the BFF is the portals' only backend; it fans out).</summary>
 public interface IDomainClient
 {
     Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default);
+
+    /// <summary>The behandelaar's werkbak — registrations awaiting beoordeling.</summary>
+    Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default);
+
+    /// <summary>Apply a behandelaar's decision (<c>goedkeuren</c>/<c>afwijzen</c>) to a registration.</summary>
+    Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default);
 }
 
 /// <summary>Port to the read projection.</summary>
@@ -37,6 +47,16 @@ public sealed class DomainClient(HttpClient http) : IDomainClient
         return new SubmitAccepted(dto.RegistrationId, dto.Status);
     }
 
+    public async Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
+        => await http.GetFromJsonAsync<List<WerkbakItem>>("behandel/werkbak", ct) ?? [];
+
+    public async Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
+    {
+        using var response = await http.PostAsJsonAsync(
+            $"registrations/{registrationId}/decide", new { besluit }, ct);
+        response.EnsureSuccessStatusCode();
+    }
+
     private sealed record DomainResponse(string RegistrationId, string Status, string? ZaakUrl);
 }
 

services/bff/Bff.Api/Program.cs

@@ -1,4 +1,6 @@
 using System.Security.Claims;
+using System.Text.Json;
+using System.Text.Json.Serialization;
 using Bff.Api;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 
@@ -6,6 +8,10 @@ var builder = WebApplication.CreateBuilder(args);
 
 var keycloakAuthority = builder.Configuration["Keycloak:Authority"]
     ?? throw new InvalidOperationException("Missing configuration 'Keycloak:Authority'");
+// Behandelaars authenticate against a *different* Keycloak realm (medewerker) than citizens (digid),
+// so the BFF validates a second issuer for the behandel endpoints (ADR-0013).
+var medewerkerAuthority = builder.Configuration["Keycloak:MedewerkerAuthority"]
+    ?? throw new InvalidOperationException("Missing configuration 'Keycloak:MedewerkerAuthority'");
 var domainBaseUrl = builder.Configuration["Downstream:Domain:BaseUrl"]
     ?? throw new InvalidOperationException("Missing configuration 'Downstream:Domain:BaseUrl'");
 var projectionBaseUrl = builder.Configuration["Downstream:Projection:BaseUrl"]
@@ -19,8 +25,28 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
         options.Authority = keycloakAuthority;
         options.RequireHttpsMetadata = false;
         options.TokenValidationParameters.ValidateAudience = false;
+    })
+    // The medewerker realm — behandel endpoints only. On validation we lift Keycloak's realm roles
+    // (the nested realm_access.roles claim) into role claims so authorization policies can require them.
+    .AddJwtBearer(BehandelAuth.Scheme, options =>
+    {
+        options.Authority = medewerkerAuthority;
+        options.RequireHttpsMetadata = false;
+        options.TokenValidationParameters.ValidateAudience = false;
+        options.Events = new JwtBearerEvents
+        {
+            OnTokenValidated = context =>
+            {
+                BehandelAuth.AddRealmRoles(context.Principal);
+                return Task.CompletedTask;
+            },
+        };
     });
-builder.Services.AddAuthorization();
+builder.Services.AddAuthorization(options =>
+    options.AddPolicy(BehandelAuth.Policy, policy => policy
+        .AddAuthenticationSchemes(BehandelAuth.Scheme)
+        .RequireAuthenticatedUser()
+        .RequireRole(BehandelAuth.BehandelaarRole)));
 
 // The BFF is the portals' only backend; it fans out to the domain and projection (§8.3).
 builder.Services.AddHttpClient<IDomainClient, DomainClient>(c => c.BaseAddress = new Uri(domainBaseUrl));
@@ -68,7 +94,79 @@ app.MapGet("/openbaar/register", async (string? q, IProjectionClient projection,
 })
     .Produces<IReadOnlyList<OpenbaarEntry>>(StatusCodes.Status200OK);
 
+// Behandelaar's werkbak: registrations awaiting beoordeling. Reached only with a medewerker-realm
+// token carrying the behandelaar role; the BFF proxies the domain's werkbak (staff view, ADR-0013).
+app.MapGet("/behandel/werkbak", async (IDomainClient domain, CancellationToken ct) =>
+    Results.Ok(await domain.GetWerkbakAsync(ct)))
+    .RequireAuthorization(BehandelAuth.Policy)
+    .Produces<IReadOnlyList<WerkbakItem>>(StatusCodes.Status200OK)
+    .Produces(StatusCodes.Status401Unauthorized)
+    .Produces(StatusCodes.Status403Forbidden);
+
+// A behandelaar's beoordeling on a registration (goedkeuren/afwijzen). Forwarded to the domain, which
+// applies the decision and completes the workflow task (ADR-0013). Same medewerker/behandelaar gate.
+app.MapPost("/behandel/registrations/{id}/decide",
+    async (string id, DecideRequest body, IDomainClient domain, CancellationToken ct) =>
+    {
+        if (!BehandelAuth.IsKnownBesluit(body.Besluit))
+            return Results.BadRequest(new { error = $"Unknown besluit '{body.Besluit}'. Expected 'goedkeuren' or 'afwijzen'." });
+
+        await domain.DecideAsync(id, body.Besluit, ct);
+        return Results.NoContent();
+    })
+    .RequireAuthorization(BehandelAuth.Policy)
+    .Produces(StatusCodes.Status204NoContent)
+    .Produces(StatusCodes.Status400BadRequest)
+    .Produces(StatusCodes.Status401Unauthorized)
+    .Produces(StatusCodes.Status403Forbidden);
+
 app.Run();
 
+/// <summary>The behandelaar's decision on a registration.</summary>
+public sealed record DecideRequest(string Besluit);
+
+// Behandel (medewerker-realm) authentication + authorization wiring (ADR-0013).
+internal static class BehandelAuth
+{
+    public const string Scheme = "medewerker";
+    public const string Policy = "behandelaar";
+    public const string BehandelaarRole = "behandelaar";
+
+    /// <summary>The beoordeling vocabulary the BFF accepts (case-insensitive); an unknown besluit is a
+    /// 400 without troubling the domain. Mirrors the domain's <c>BeoordelingsBesluit</c>.</summary>
+    public static bool IsKnownBesluit(string? besluit) =>
+        string.Equals(besluit, "goedkeuren", StringComparison.OrdinalIgnoreCase) ||
+        string.Equals(besluit, "afwijzen", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>Lift Keycloak's realm roles (the nested <c>realm_access.roles</c> claim) onto the
+    /// principal as role claims, so <c>RequireRole</c> can authorize on them.</summary>
+    public static void AddRealmRoles(ClaimsPrincipal? principal)
+    {
+        if (principal?.Identity is not ClaimsIdentity identity)
+            return;
+
+        var realmAccess = principal.FindFirst("realm_access")?.Value;
+        if (string.IsNullOrWhiteSpace(realmAccess))
+            return;
+
+        // A malformed realm_access claim must not fail authentication (a throw here becomes a 401);
+        // it simply yields no roles, so the authorization policy answers 403.
+        string[] roles;
+        try
+        {
+            roles = JsonSerializer.Deserialize<RealmAccess>(realmAccess)?.Roles ?? [];
+        }
+        catch (JsonException)
+        {
+            return;
+        }
+
+        foreach (var role in roles)
+            identity.AddClaim(new Claim(identity.RoleClaimType, role));
+    }
+
+    private sealed record RealmAccess([property: JsonPropertyName("roles")] string[] Roles);
+}
+
 // Exposed so the test host (WebApplicationFactory<Program>) can boot the app.
 public partial class Program;

services/bff/Bff.Api/appsettings.json

@@ -7,7 +7,8 @@
   },
   "AllowedHosts": "*",
   "Keycloak": {
-    "Authority": "http://localhost:8180/realms/digid"
+    "Authority": "http://localhost:8180/realms/digid",
+    "MedewerkerAuthority": "http://localhost:8180/realms/medewerker"
   },
   "Downstream": {
     "Domain": { "BaseUrl": "http://localhost:8130/" },

services/bff/Bff.Tests/BehandelEndpointTests.cs

@@ -0,0 +1,114 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using Bff.Api;
+
+namespace Bff.Tests;
+
+/// <summary>
+/// The behandel werkbak endpoint (S-12c): reached only with a medewerker-realm token that carries the
+/// <c>behandelaar</c> role. A missing token is 401; an authenticated medewerker without the role is
+/// 403; a behandelaar gets the werkbak (staff view, incl. bsn).
+/// </summary>
+public class BehandelEndpointTests
+{
+    private static HttpRequestMessage Werkbak(string? bearer)
+    {
+        var request = new HttpRequestMessage(HttpMethod.Get, "/behandel/werkbak");
+        if (bearer is not null)
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+        return request;
+    }
+
+    [Fact]
+    public async Task Rejects_the_werkbak_without_a_token()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(Werkbak(bearer: null));
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Rejects_a_medewerker_without_the_behandelaar_role()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(Werkbak(TestTokens.Medewerker("teamlead")));
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Serves_the_werkbak_to_a_behandelaar()
+    {
+        using var factory = new BffFactory();
+        factory.Domain.Werkbak.Add(new WerkbakItem("reg-1", "123456782", "InBehandeling"));
+
+        var response = await factory.CreateClient().SendAsync(Werkbak(TestTokens.Medewerker("behandelaar")));
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var items = await response.Content.ReadFromJsonAsync<List<WerkbakItem>>();
+        var item = Assert.Single(items!);
+        Assert.Equal("reg-1", item.RegistrationId);
+        Assert.Equal("123456782", item.Bsn);
+    }
+
+    private static HttpRequestMessage Decide(string? bearer, string id = "reg-1", string besluit = "goedkeuren")
+    {
+        var request = new HttpRequestMessage(HttpMethod.Post, $"/behandel/registrations/{id}/decide")
+        {
+            Content = JsonContent.Create(new { besluit }),
+        };
+        if (bearer is not null)
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+        return request;
+    }
+
+    [Fact]
+    public async Task Rejects_a_decision_without_a_token()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(Decide(bearer: null));
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        Assert.Null(factory.Domain.Decided);
+    }
+
+    [Fact]
+    public async Task Rejects_a_decision_from_a_medewerker_without_the_behandelaar_role()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(Decide(TestTokens.Medewerker("teamlead")));
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Null(factory.Domain.Decided);
+    }
+
+    [Fact]
+    public async Task Forwards_a_behandelaar_decision_to_the_domain()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient()
+            .SendAsync(Decide(TestTokens.Medewerker("behandelaar"), id: "reg-42", besluit: "afwijzen"));
+
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+        Assert.Equal(("reg-42", "afwijzen"), factory.Domain.Decided);
+    }
+
+    [Fact]
+    public async Task Rejects_an_unknown_besluit_without_calling_the_domain()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient()
+            .SendAsync(Decide(TestTokens.Medewerker("behandelaar"), besluit: "misschien"));
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        Assert.Null(factory.Domain.Decided);
+    }
+}

services/bff/Bff.Tests/BffFactory.cs

@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.AspNetCore.TestHost;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Microsoft.IdentityModel.Tokens;
 
@@ -23,24 +24,19 @@ internal sealed class BffFactory : WebApplicationFactory<Program>
     public FakeDomainClient Domain { get; } = new();
     public FakeProjectionClient Projection { get; } = new();
 
-    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    private static void ValidateWithTestKey(IServiceCollection services, string scheme) =>
+        services.Configure<JwtBearerOptions>(scheme, options =>
         {
-        builder.UseSetting("Keycloak:Authority", "https://keycloak.invalid/realms/digid");
+            // Validate locally against the test key and NEVER reach out for OIDC metadata. A static
-        builder.UseSetting("Downstream:Domain:BaseUrl", "http://domain.invalid/");
+            // configuration manager guarantees this regardless of Configure/PostConfigure ordering —
-        builder.UseSetting("Downstream:Projection:BaseUrl", "http://projection.invalid/");
+            // clearing Authority alone left the medewerker scheme fetching metadata under CI timing
-
+            // (2s hang → 401), because JwtBearer's PostConfigure could still build a ConfigurationManager.
-        builder.ConfigureTestServices(services =>
-        {
-            services.AddSingleton<IDomainClient>(Domain);
-            services.AddSingleton<IProjectionClient>(Projection);
-
-            services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
-            {
-                // Validate locally against the test key; never reach out for OIDC metadata.
             options.Authority = null;
             options.MetadataAddress = null!;
             options.RequireHttpsMetadata = false;
             options.Configuration = new OpenIdConnectConfiguration();
+            options.ConfigurationManager =
+                new StaticConfigurationManager<OpenIdConnectConfiguration>(new OpenIdConnectConfiguration());
             options.TokenValidationParameters = new TokenValidationParameters
             {
                 ValidateIssuer = false,
@@ -51,6 +47,24 @@ internal sealed class BffFactory : WebApplicationFactory<Program>
                 ClockSkew = TimeSpan.Zero,
             };
         });
+
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        builder.UseSetting("Keycloak:Authority", "https://keycloak.invalid/realms/digid");
+        builder.UseSetting("Keycloak:MedewerkerAuthority", "https://keycloak.invalid/realms/medewerker");
+        builder.UseSetting("Downstream:Domain:BaseUrl", "http://domain.invalid/");
+        builder.UseSetting("Downstream:Projection:BaseUrl", "http://projection.invalid/");
+
+        builder.ConfigureTestServices(services =>
+        {
+            services.AddSingleton<IDomainClient>(Domain);
+            services.AddSingleton<IProjectionClient>(Projection);
+
+            // Both realms validate locally against the test key (no live Keycloak). The medewerker
+            // scheme keeps its OnTokenValidated role-lifting from Program.cs — only the validation
+            // parameters are swapped here.
+            ValidateWithTestKey(services, JwtBearerDefaults.AuthenticationScheme);
+            ValidateWithTestKey(services, "medewerker");
         });
     }
 }
@@ -60,12 +74,24 @@ internal sealed class FakeDomainClient : IDomainClient
 {
     public string? SubmittedBsn { get; private set; }
     public SubmitAccepted Result { get; set; } = new("reg-123", "Ingediend");
+    public List<WerkbakItem> Werkbak { get; } = [];
 
     public Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default)
     {
         SubmittedBsn = bsn;
         return Task.FromResult(Result);
     }
+
+    public (string RegistrationId, string Besluit)? Decided { get; private set; }
+
+    public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
+        => Task.FromResult<IReadOnlyList<WerkbakItem>>(Werkbak);
+
+    public Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
+    {
+        Decided = (registrationId, besluit);
+        return Task.CompletedTask;
+    }
 }
 
 /// <summary>Serves a configurable set of projection rows.</summary>

services/bff/Bff.Tests/TestTokens.cs

@@ -17,6 +17,22 @@ internal static class TestTokens
         new SymmetricSecurityKey(Encoding.UTF8.GetBytes("a-different-signing-key-256-bits-long-indeed-yes!")),
         expired: false);
 
+    /// <summary>A medewerker-realm token carrying the given realm roles under <c>realm_access.roles</c>
+    /// (Keycloak's shape), signed with the valid test key. Used to exercise behandel authorization.</summary>
+    public static string Medewerker(params string[] roles)
+    {
+        var handler = new JsonWebTokenHandler();
+        return handler.CreateToken(new SecurityTokenDescriptor
+        {
+            Claims = new Dictionary<string, object>
+            {
+                ["realm_access"] = new Dictionary<string, object> { ["roles"] = roles },
+            },
+            Expires = DateTime.UtcNow.AddMinutes(30),
+            SigningCredentials = new SigningCredentials(BffFactory.TestSigningKey, SecurityAlgorithms.HmacSha256),
+        });
+    }
+
     private static string Create(string bsn, SymmetricSecurityKey key, bool expired)
     {
         var handler = new JsonWebTokenHandler();

services/bff/openapi.json

@@ -60,10 +60,90 @@
           }
         }
       }
+    },
+    "/behandel/werkbak": {
+      "get": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/WerkbakItem"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden"
+          }
+        }
+      }
+    },
+    "/behandel/registrations/{id}/decide": {
+      "post": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DecideRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "description": "Bad Request"
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden"
+          }
+        }
+      }
     }
   },
   "components": {
     "schemas": {
+      "DecideRequest": {
+        "required": [
+          "besluit"
+        ],
+        "type": "object",
+        "properties": {
+          "besluit": {
+            "type": "string"
+          }
+        }
+      },
       "OpenbaarEntry": {
         "required": [
           "id",
@@ -100,6 +180,25 @@
             "type": "string"
           }
         }
+      },
+      "WerkbakItem": {
+        "required": [
+          "registrationId",
+          "bsn",
+          "status"
+        ],
+        "type": "object",
+        "properties": {
+          "registrationId": {
+            "type": "string"
+          },
+          "bsn": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          }
+        }
       }
     }
   },

services/domain/Big.Api/Program.cs

@@ -26,6 +26,7 @@ builder.Services.AddHttpClient<IAclClient, AclHttpClient>();
 builder.Services.AddScoped<SubmitRegistration>();
 builder.Services.AddScoped<ApproveRegistration>();
 builder.Services.AddScoped<BeoordeelRegistratie>();
+builder.Services.AddScoped<Werkbak>();
 builder.Services.AddScoped<OpenZaakWorker>();
 builder.Services.AddScoped<OpenZaakJobProcessor>();
 
@@ -73,6 +74,12 @@ app.MapPost("/registrations/{id}/decide", async (string id, DecideRequest body,
     return Results.NoContent();
 });
 
+// The behandelaar's werkbak (S-12): the registrations awaiting beoordeling, read from the open
+// Beoordelen user tasks (§8.2) and enriched with bsn + status. The BFF proxies this behind
+// medewerker-realm + behandelaar-role authorization; the domain trusts its callers (§8.3).
+app.MapGet("/behandel/werkbak", async (Werkbak werkbak, CancellationToken ct) =>
+    Results.Ok(await werkbak.GetAsync(ct)));
+
 // Read a registration. Its zaak URL appears once the worker has opened the zaak (eventually).
 app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, CancellationToken ct) =>
 {

services/domain/Big.Application/BeoordeelRegistratie.cs

@@ -20,10 +20,12 @@ public sealed record BeoordeelRegistratieCommand(RegistrationId RegistrationId,
 /// <see cref="BeoordelingsBesluit.Goedkeuren"/> sets the zaak's final status via the ACL (§8.1) and
 /// advances the aggregate to INGESCHREVEN; <see cref="BeoordelingsBesluit.Afwijzen"/> advances it to
 /// AFGEWEZEN in the domain (propagating a rejection to the zaak, so the openbaar projection reflects
-/// it, is a later sub-slice of S-12). Both decisions are idempotent — a repeated or redelivered
+/// it, is a later sub-slice of S-12). After applying the decision it completes the Flowable
-/// decision that matches the current terminal state is a no-op, so the ACL is not called twice.
+/// <c>Beoordelen</c> task (found by registrationId) so the workflow advances (ADR-0013). Both
+/// decisions are idempotent — a repeated or redelivered decision that matches the current terminal
+/// state is a no-op, so the ACL is not called and the task not completed twice.
 /// </summary>
-public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl)
+public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl, IUserTaskClient tasks)
 {
     public async Task HandleAsync(BeoordeelRegistratieCommand command, CancellationToken ct = default)
     {
@@ -53,5 +55,17 @@ public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient ac
         }
 
         await store.SaveAsync(registration, ct);
+        await CompleteWorkflowTaskAsync(command.RegistrationId, command.Besluit, ct);
+    }
+
+    // Advance the workflow: complete the open Beoordelen task for this registration. If none is open
+    // (already completed, or the process hasn't parked yet) the decision still stands — we complete
+    // nothing rather than fail.
+    private async Task CompleteWorkflowTaskAsync(RegistrationId registrationId, BeoordelingsBesluit besluit, CancellationToken ct)
+    {
+        var open = await tasks.GetOpenBeoordelingenAsync(ct);
+        var task = open.FirstOrDefault(t => t.RegistrationId == registrationId);
+        if (task is not null)
+            await tasks.CompleteBeoordelingAsync(task.TaskId, besluit, ct);
     }
 }

services/domain/Big.Application/Werkbak.cs

@@ -0,0 +1,32 @@
+namespace Big.Application;
+
+/// <summary>One row of the behandelaar's werkbak: a registration awaiting beoordeling, with the
+/// public-facing reference (its id) plus the bsn and status a behandelaar needs to triage it.</summary>
+public sealed record WerkbakItem(string RegistrationId, string Bsn, string Status);
+
+/// <summary>
+/// The werkbak query (S-12c): the registrations awaiting a behandelaar's beoordeling. It reads the
+/// open <c>Beoordelen</c> tasks from the workflow engine (§8.2, via <see cref="IUserTaskClient"/>) —
+/// the authoritative set of work items — and enriches each with its aggregate (bsn + status). A task
+/// whose registration the domain doesn't know is skipped rather than invented.
+/// </summary>
+public sealed class Werkbak(IUserTaskClient tasks, IRegistrationStore store)
+{
+    public async Task<IReadOnlyList<WerkbakItem>> GetAsync(CancellationToken ct = default)
+    {
+        var open = await tasks.GetOpenBeoordelingenAsync(ct);
+
+        var items = new List<WerkbakItem>(open.Count);
+        foreach (var task in open)
+        {
+            var registration = await store.GetAsync(task.RegistrationId, ct);
+            if (registration is null)
+                continue;
+
+            items.Add(new WerkbakItem(
+                registration.Id.ToString(), registration.Bsn, registration.Status.ToString()));
+        }
+
+        return items;
+    }
+}

services/domain/Big.Tests/BeoordeelRegistratieTests.cs

@@ -6,8 +6,8 @@ namespace Big.Tests;
 /// <summary>
 /// The beoordeling use case (S-12): a behandelaar's decision on a registration. Goedkeuren sets the
 /// zaak's final status via the ACL (§8.1) and marks the aggregate INGESCHREVEN; Afwijzen marks it
-/// AFGEWEZEN in the domain (propagating a rejection to the zaak is a later sub-slice). Both are
+/// AFGEWEZEN. Either way the decision also completes the Flowable Beoordelen task (found by
-/// idempotent so a repeated or redelivered decision is a no-op.
+/// registrationId) so the process advances. All idempotent — a repeated decision is a no-op.
 /// </summary>
 public class BeoordeelRegistratieTests
 {
@@ -18,6 +18,9 @@ public class BeoordeelRegistratieTests
         return registration;
     }
 
+    private static FakeUserTaskClient TaskFor(Registration registration) =>
+        new([new BeoordelingTask("task-1", registration.Id)]);
+
     [Fact]
     public async Task Goedkeuren_sets_the_zaak_status_via_the_acl_and_marks_the_registration_ingeschreven()
     {
@@ -25,7 +28,8 @@ public class BeoordeelRegistratieTests
         var acl = new FakeAclClient();
         var registration = WithZaak();
         store.Seed(registration);
-        var handler = new BeoordeelRegistratie(store, acl);
+        var tasks = TaskFor(registration);
+        var handler = new BeoordeelRegistratie(store, acl, tasks);
 
         await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
 
@@ -34,6 +38,8 @@ public class BeoordeelRegistratieTests
         Assert.Equal(FakeAclClient.DefaultZaakUrl, acl.ApprovedZaakUrl);
         Assert.Equal(1, acl.ApproveCallCount);
         Assert.Equal(1, store.SaveCount);
+        // The behandelaar's decision advances the workflow: the Beoordelen task is completed.
+        Assert.Equal(("task-1", BeoordelingsBesluit.Goedkeuren), tasks.Completed);
     }
 
     [Fact]
@@ -43,7 +49,8 @@ public class BeoordeelRegistratieTests
         var acl = new FakeAclClient();
         var registration = WithZaak();
         store.Seed(registration);
-        var handler = new BeoordeelRegistratie(store, acl);
+        var tasks = TaskFor(registration);
+        var handler = new BeoordeelRegistratie(store, acl, tasks);
 
         await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Afwijzen));
 
@@ -51,6 +58,7 @@ public class BeoordeelRegistratieTests
         Assert.Equal(RegistrationStatus.Afgewezen, saved!.Status);
         Assert.Equal(0, acl.ApproveCallCount);
         Assert.Equal(1, store.SaveCount);
+        Assert.Equal(("task-1", BeoordelingsBesluit.Afwijzen), tasks.Completed);
     }
 
     [Fact]
@@ -61,7 +69,7 @@ public class BeoordeelRegistratieTests
         var registration = WithZaak();
         registration.TakeIntoBehandeling();
         store.Seed(registration);
-        var handler = new BeoordeelRegistratie(store, acl);
+        var handler = new BeoordeelRegistratie(store, acl, TaskFor(registration));
 
         await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
 
@@ -73,7 +81,7 @@ public class BeoordeelRegistratieTests
     {
         var store = new FakeRegistrationStore();
         var acl = new FakeAclClient();
-        var handler = new BeoordeelRegistratie(store, acl);
+        var handler = new BeoordeelRegistratie(store, acl, new FakeUserTaskClient([]));
 
         await Assert.ThrowsAsync<ArgumentNullException>(() => handler.HandleAsync(null!));
         Assert.Equal(0, acl.ApproveCallCount);
@@ -85,7 +93,7 @@ public class BeoordeelRegistratieTests
     {
         var store = new FakeRegistrationStore();
         var acl = new FakeAclClient();
-        var handler = new BeoordeelRegistratie(store, acl);
+        var handler = new BeoordeelRegistratie(store, acl, new FakeUserTaskClient([]));
 
         var ex = await Assert.ThrowsAsync<InvalidOperationException>(() =>
             handler.HandleAsync(new BeoordeelRegistratieCommand(RegistrationId.New(), BeoordelingsBesluit.Goedkeuren)));
@@ -100,7 +108,7 @@ public class BeoordeelRegistratieTests
         var acl = new FakeAclClient();
         var registration = Registration.Submit("123456782"); // no zaak yet
         store.Seed(registration);
-        var handler = new BeoordeelRegistratie(store, acl);
+        var handler = new BeoordeelRegistratie(store, acl, TaskFor(registration));
 
         var ex = await Assert.ThrowsAsync<InvalidOperationException>(() =>
             handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren)));
@@ -115,7 +123,7 @@ public class BeoordeelRegistratieTests
         var acl = new FakeAclClient();
         var registration = WithZaak();
         store.Seed(registration);
-        var handler = new BeoordeelRegistratie(store, acl);
+        var handler = new BeoordeelRegistratie(store, acl, TaskFor(registration));
 
         await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
         await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
@@ -131,7 +139,7 @@ public class BeoordeelRegistratieTests
         var acl = new FakeAclClient();
         var registration = WithZaak();
         store.Seed(registration);
-        var handler = new BeoordeelRegistratie(store, acl);
+        var handler = new BeoordeelRegistratie(store, acl, TaskFor(registration));
 
         await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Afwijzen));
         await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Afwijzen));
@@ -139,4 +147,22 @@ public class BeoordeelRegistratieTests
         Assert.Equal(1, store.SaveCount);
         Assert.Equal(RegistrationStatus.Afgewezen, (await store.GetAsync(registration.Id))!.Status);
     }
+
+    [Fact]
+    public async Task Deciding_completes_no_task_when_none_is_open_for_the_registration()
+    {
+        // The task may already be gone (redelivery / manual completion). The decision still applies
+        // and simply completes nothing rather than failing.
+        var store = new FakeRegistrationStore();
+        var acl = new FakeAclClient();
+        var registration = WithZaak();
+        store.Seed(registration);
+        var tasks = new FakeUserTaskClient([]); // no open task for this registration
+        var handler = new BeoordeelRegistratie(store, acl, tasks);
+
+        await handler.HandleAsync(new BeoordeelRegistratieCommand(registration.Id, BeoordelingsBesluit.Goedkeuren));
+
+        Assert.Equal(RegistrationStatus.Ingeschreven, (await store.GetAsync(registration.Id))!.Status);
+        Assert.Null(tasks.Completed);
+    }
 }

services/domain/Big.Tests/Fakes.cs

@@ -41,6 +41,29 @@ internal sealed class FakeWorkflowClient(string processInstanceId = "proc-1", Ac
     }
 }
 
+/// <summary>A fake user-task client for the werkbak/decision use cases: returns a scripted set of
+/// open beoordeling tasks and records claim/complete calls.</summary>
+internal sealed class FakeUserTaskClient(IReadOnlyList<BeoordelingTask> open) : IUserTaskClient
+{
+    public (string TaskId, string Behandelaar)? Claimed { get; private set; }
+    public (string TaskId, BeoordelingsBesluit Besluit)? Completed { get; private set; }
+
+    public Task<IReadOnlyList<BeoordelingTask>> GetOpenBeoordelingenAsync(CancellationToken ct = default)
+        => Task.FromResult(open);
+
+    public Task ClaimAsync(string taskId, string behandelaar, CancellationToken ct = default)
+    {
+        Claimed = (taskId, behandelaar);
+        return Task.CompletedTask;
+    }
+
+    public Task CompleteBeoordelingAsync(string taskId, BeoordelingsBesluit besluit, CancellationToken ct = default)
+    {
+        Completed = (taskId, besluit);
+        return Task.CompletedTask;
+    }
+}
+
 /// <summary>A fake ACL client that records the bsn it was asked to open a zaak for and returns a
 /// fixed zaak URL.</summary>
 internal sealed class FakeAclClient(Uri? zaakUrl = null) : IAclClient

services/domain/Big.Tests/WerkbakTests.cs

@@ -0,0 +1,49 @@
+using Big.Application;
+using Big.Domain;
+
+namespace Big.Tests;
+
+/// <summary>
+/// The werkbak query (S-12c): the behandelaar's list of registrations awaiting beoordeling. It reads
+/// the open Beoordelen tasks from the workflow engine (§8.2) and enriches each with its registration
+/// (bsn + status) from the store. A task whose registration is unknown is skipped defensively.
+/// </summary>
+public class WerkbakTests
+{
+    [Fact]
+    public async Task Lists_an_item_per_open_beoordeling_enriched_from_the_registration()
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Registration.Submit("123456782");
+        registration.AttachZaak(FakeAclClient.DefaultZaakUrl);
+        registration.TakeIntoBehandeling();
+        store.Seed(registration);
+        var tasks = new FakeUserTaskClient([new BeoordelingTask("task-1", registration.Id)]);
+        var werkbak = new Werkbak(tasks, store);
+
+        var items = await werkbak.GetAsync();
+
+        var item = Assert.Single(items);
+        Assert.Equal(registration.Id.ToString(), item.RegistrationId);
+        Assert.Equal("123456782", item.Bsn);
+        Assert.Equal("InBehandeling", item.Status);
+    }
+
+    [Fact]
+    public async Task Is_empty_when_no_beoordelingen_are_open()
+    {
+        var werkbak = new Werkbak(new FakeUserTaskClient([]), new FakeRegistrationStore());
+
+        Assert.Empty(await werkbak.GetAsync());
+    }
+
+    [Fact]
+    public async Task Skips_a_task_whose_registration_is_unknown()
+    {
+        // Defensive: the werkbak never invents an item for a task the domain has no aggregate for.
+        var tasks = new FakeUserTaskClient([new BeoordelingTask("task-1", RegistrationId.New())]);
+        var werkbak = new Werkbak(tasks, new FakeRegistrationStore());
+
+        Assert.Empty(await werkbak.GetAsync());
+    }
+}

tests/acceptance/Features/EenRegistratieBeoordelen.feature

@@ -15,6 +15,7 @@ Feature: Een registratie beoordelen
     When the behandelaar decides "goedkeuren"
     Then the registration has status "INGESCHREVEN"
     And the zaak's final status is set via the ACL
+    And the beoordeling task is completed with "goedkeuren"
 
   Scenario: Afwijzen wijst de registratie af zonder de ACL
     Given a submitted registration with an opened zaak
@@ -22,3 +23,4 @@ Feature: Een registratie beoordelen
     And the behandelaar decides "afwijzen"
     Then the registration has status "AFGEWEZEN"
     And the ACL is not asked to set the zaak status
+    And the beoordeling task is completed with "afwijzen"

tests/acceptance/Steps/EenRegistratieBeoordelenSteps.cs

@@ -16,6 +16,7 @@ public sealed class EenRegistratieBeoordelenSteps
 {
     private readonly InMemoryAclClient _acl = new();
     private readonly InMemoryRegistrationStore _store = new();
+    private readonly InMemoryUserTaskClient _tasks = new();
     private RegistrationId _id;
 
     [Given("a submitted registration with an opened zaak")]
@@ -25,6 +26,8 @@ public sealed class EenRegistratieBeoordelenSteps
         registration.AttachZaak(InMemoryAclClient.OpenedZaakUrl);
         await _store.SaveAsync(registration);
         _id = registration.Id;
+        // The process has parked at the Beoordelen user task awaiting the behandelaar.
+        _tasks.Open(_id);
     }
 
     [When("the behandelaar takes it into behandeling")]
@@ -37,7 +40,7 @@ public sealed class EenRegistratieBeoordelenSteps
 
     [When("the behandelaar decides \"(.*)\"")]
     public async Task WhenTheBehandelaarDecides(string besluit)
-        => await new BeoordeelRegistratie(_store, _acl).HandleAsync(
+        => await new BeoordeelRegistratie(_store, _acl, _tasks).HandleAsync(
             new BeoordeelRegistratieCommand(_id, Enum.Parse<BeoordelingsBesluit>(besluit, ignoreCase: true)));
 
     [Then("the registration has status \"(.*)\"")]
@@ -55,4 +58,8 @@ public sealed class EenRegistratieBeoordelenSteps
     [Then("the ACL is not asked to set the zaak status")]
     public void ThenTheAclIsNotAskedToSetTheZaakStatus()
         => Assert.Null(_acl.ApprovedZaakUrl);
+
+    [Then("the beoordeling task is completed with \"(.*)\"")]
+    public void ThenTheBeoordelingTaskIsCompletedWith(string besluit)
+        => Assert.Equal(Enum.Parse<BeoordelingsBesluit>(besluit, ignoreCase: true), _tasks.Completed?.Besluit);
 }

tests/acceptance/Support/BffAcceptanceHost.cs

@@ -68,6 +68,12 @@ public sealed class CapturingDomainClient : IDomainClient
         SubmittedBsn = bsn;
         return Task.FromResult(new SubmitAccepted("reg-acc-1", "Ingediend"));
     }
+
+    public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
+        => Task.FromResult<IReadOnlyList<WerkbakItem>>([]);
+
+    public Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
+        => Task.CompletedTask;
 }
 
 /// <summary>Serves configurable projection rows.</summary>

tests/acceptance/Support/InMemoryDomainPorts.cs

@@ -43,6 +43,29 @@ public sealed class InMemoryAclClient : IAclClient
     }
 }
 
+/// <summary>An in-memory user-task client for the beoordeling acceptance scenario: it holds one open
+/// Beoordelen task per registration and records the besluit each is completed with.</summary>
+public sealed class InMemoryUserTaskClient : IUserTaskClient
+{
+    private readonly List<BeoordelingTask> _open = [];
+
+    public (string TaskId, BeoordelingsBesluit Besluit)? Completed { get; private set; }
+
+    public void Open(RegistrationId registrationId) => _open.Add(new BeoordelingTask($"task-{registrationId}", registrationId));
+
+    public Task<IReadOnlyList<BeoordelingTask>> GetOpenBeoordelingenAsync(CancellationToken ct = default)
+        => Task.FromResult<IReadOnlyList<BeoordelingTask>>(_open);
+
+    public Task ClaimAsync(string taskId, string behandelaar, CancellationToken ct = default) => Task.CompletedTask;
+
+    public Task CompleteBeoordelingAsync(string taskId, BeoordelingsBesluit besluit, CancellationToken ct = default)
+    {
+        Completed = (taskId, besluit);
+        _open.RemoveAll(t => t.TaskId == taskId);
+        return Task.CompletedTask;
+    }
+}
+
 /// <summary>An in-memory registration store for the domain acceptance scenario.</summary>
 public sealed class InMemoryRegistrationStore : IRegistrationStore
 {