# UJ-106 Suspend customer account

Audience: AI coding agents first.

- Actor + entry point: Authorized support staff; `/users/{userId}`.
- Priority: MUST-HAVE.
- Preconditions: Create active account through public registration API.
- Test layer: L3.

## Steps

1. Open active account → `Active` badge and `Suspend Account` render (`admin-panel/src/pages/UserDetailPage.tsx:179-195`).
2. Activate suspend and confirm → `POST /v1/admin/users/{id}/suspend` runs (`admin-panel/src/pages/UserDetailPage.tsx:123-129`).
3. Success → badge changes to suspended and action becomes `Activate Account`; reload preserves suspended state.
4. Attempt customer API use → customer-visible auth/entitlement denial confirms enforcement.

## Failure branches

- Auth/role failure → `401/403`; account remains active.
- Rate limit `429` → visible error; state remains authoritative after refresh.
- Duplicate suspend → idempotent suspended result; one audit event per accepted state change.

## Backend touchpoints

`POST /v1/admin/users/{userId}/suspend`; `GET /v1/admin/users/{userId}`; customer auth/API probe; audit read.