diff --git a/pkg/envoy/store/automation.go b/pkg/envoy/store/automation.go
index 223840815..2b5349a59 100644
--- a/pkg/envoy/store/automation.go
+++ b/pkg/envoy/store/automation.go
@@ -135,7 +135,8 @@ func (df *DecodeFilter) automationFromResource(rr ...string) *DecodeFilter {
 		switch strings.ToLower(r) {
 		case "automation:workflow":
 			df = df.AutomationWorkflows(&types.WorkflowFilter{
-				Query: id,
+				Query:    id,
+				Disabled: filter.StateInclusive,
 			})
 		}
 	}
diff --git a/pkg/envoy/yaml/compose_chart_unmarshal.go b/pkg/envoy/yaml/compose_chart_unmarshal.go
index 2d6199d25..39009d3f5 100644
--- a/pkg/envoy/yaml/compose_chart_unmarshal.go
+++ b/pkg/envoy/yaml/compose_chart_unmarshal.go
@@ -160,6 +160,11 @@ func (wrap *composeChartConfigReport) UnmarshalYAML(n *yaml.Node) error {
 
 	return y7s.EachMap(n, func(k, v *yaml.Node) (err error) {
 		switch k.Value {
+		case "y",
+			"yAxis",
+			"YAxis":
+			wrap.report.YAxis = make(map[string]interface{})
+			return v.Decode(&wrap.report.YAxis)
 		case "module":
 			// custom decoder for referenced module
 			// we'll copy this to the dedicated prop of the wrapping structure
diff --git a/tests/envoy/compose.go b/tests/envoy/compose.go
index b9e24c30f..f822a7361 100644
--- a/tests/envoy/compose.go
+++ b/tests/envoy/compose.go
@@ -220,6 +220,10 @@ func sTestComposeChart(ctx context.Context, t *testing.T, s store.Storer, nsID,
 				{
 					Filter:   "filter",
 					ModuleID: modID,
+					YAxis: map[string]interface{}{
+						"beginAtZero": true,
+						"label":       "Euro",
+					},
 				},
 			},
 			ColorScheme: "colorscheme",
diff --git a/tests/envoy/store_yaml_base_test.go b/tests/envoy/store_yaml_base_test.go
index 85009253e..cb7b9206e 100644
--- a/tests/envoy/store_yaml_base_test.go
+++ b/tests/envoy/store_yaml_base_test.go
@@ -2,14 +2,19 @@ package envoy
 
 import (
 	"context"
+	"fmt"
+	"strconv"
 	"testing"
 	"time"
 
+	atypes "github.com/cortezaproject/corteza-server/automation/types"
+	"github.com/cortezaproject/corteza-server/compose/types"
 	"github.com/cortezaproject/corteza-server/pkg/auth"
 	"github.com/cortezaproject/corteza-server/pkg/envoy"
 	"github.com/cortezaproject/corteza-server/pkg/envoy/resource"
 	su "github.com/cortezaproject/corteza-server/pkg/envoy/store"
 	"github.com/cortezaproject/corteza-server/pkg/envoy/yaml"
+	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/store"
 	stypes "github.com/cortezaproject/corteza-server/system/types"
 	"github.com/stretchr/testify/require"
@@ -44,464 +49,467 @@ func TestStoreYaml_base(t *testing.T) {
 	}
 
 	cases := []*tc{
-		// {
-		// 	name: "base automation workflow",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		wf := sTestAutomationWorkflow(ctx, t, s, "base")
-		// 		sTestAutomationTrigger(ctx, t, s, wf.ID, "base")
+		{
+			name: "base automation workflow",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				wf := sTestAutomationWorkflow(ctx, t, s, "base")
+				sTestAutomationTrigger(ctx, t, s, wf.ID, "base")
 
-		// 		df := su.NewDecodeFilter().AutomationWorkflows(&atypes.WorkflowFilter{})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		wf, err := store.LookupAutomationWorkflowByHandle(ctx, s, "base_handle")
-		// 		req.NoError(err)
-		// 		req.NotNil(wf)
+				df := su.NewDecodeFilter().AutomationWorkflows(&atypes.WorkflowFilter{})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				wf, err := store.LookupAutomationWorkflowByHandle(ctx, s, "base_handle")
+				req.NoError(err)
+				req.NotNil(wf)
 
-		// 		req.Equal("base_handle", wf.Handle)
-		// 		req.Equal("base_name", wf.Meta.Name)
-		// 		req.Equal("base_description", wf.Meta.Description)
-		// 		req.True(wf.Enabled)
-		// 		req.True(wf.Trace)
-		// 		req.Equal(10, wf.KeepSessions)
-		// 		req.Len(wf.Steps, 2)
-		// 		req.Len(wf.Paths, 1)
-		// 		req.Equal(createdAt.Format(time.RFC3339), wf.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), wf.UpdatedAt.Format(time.RFC3339))
+				req.Equal("base_handle", wf.Handle)
+				req.Equal("base_name", wf.Meta.Name)
+				req.Equal("base_description", wf.Meta.Description)
+				req.True(wf.Enabled)
+				req.True(wf.Trace)
+				req.Equal(10, wf.KeepSessions)
+				req.Len(wf.Steps, 2)
+				req.Len(wf.Paths, 1)
+				req.Equal(createdAt.Format(time.RFC3339), wf.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), wf.UpdatedAt.Format(time.RFC3339))
 
-		// 		tt, _, err := store.SearchAutomationTriggers(ctx, s, atypes.TriggerFilter{
-		// 			WorkflowID: []uint64{wf.ID},
-		// 		})
-		// 		req.NoError(err)
-		// 		req.NotNil(tt)
-		// 		req.Len(tt, 1)
-		// 	},
-		// },
+				tt, _, err := store.SearchAutomationTriggers(ctx, s, atypes.TriggerFilter{
+					WorkflowID: []uint64{wf.ID},
+				})
+				req.NoError(err)
+				req.NotNil(tt)
+				req.Len(tt, 1)
+			},
+		},
 
-		// {
-		// 	name: "base namespace",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		sTestComposeNamespace(ctx, t, s, "base")
-		// 		df := su.NewDecodeFilter().ComposeNamespace(&types.NamespaceFilter{
-		// 			Slug: "base_namespace",
-		// 		})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		n, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
-		// 		req.NoError(err)
+		{
+			name: "base namespace",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				sTestComposeNamespace(ctx, t, s, "base")
+				df := su.NewDecodeFilter().ComposeNamespace(&types.NamespaceFilter{
+					Slug: "base_namespace",
+				})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				n, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
+				req.NoError(err)
 
-		// 		req.Equal("base namespace", n.Name)
-		// 		req.Equal("base_namespace", n.Slug)
-		// 		req.True(n.Enabled)
-		// 		req.Equal("subtitle", n.Meta.Subtitle)
-		// 		req.Equal("description", n.Meta.Description)
-		// 		req.Equal(createdAt.Format(time.RFC3339), n.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), n.UpdatedAt.Format(time.RFC3339))
-		// 	},
-		// },
+				req.Equal("base namespace", n.Name)
+				req.Equal("base_namespace", n.Slug)
+				req.True(n.Enabled)
+				req.Equal("subtitle", n.Meta.Subtitle)
+				req.Equal("description", n.Meta.Description)
+				req.Equal(createdAt.Format(time.RFC3339), n.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), n.UpdatedAt.Format(time.RFC3339))
+			},
+		},
 
-		// {
-		// 	name: "base module",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		ns := sTestComposeNamespace(ctx, t, s, "base")
-		// 		sTestComposeModule(ctx, t, s, ns.ID, "base")
+		{
+			name: "base module",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				ns := sTestComposeNamespace(ctx, t, s, "base")
+				sTestComposeModule(ctx, t, s, ns.ID, "base")
 
-		// 		df := su.NewDecodeFilter().
-		// 			ComposeNamespace(&types.NamespaceFilter{
-		// 				Slug: "base_namespace",
-		// 			}).
-		// 			ComposeModule(&types.ModuleFilter{
-		// 				NamespaceID: ns.ID,
-		// 				Handle:      "base_module",
-		// 			})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		n, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
-		// 		req.NoError(err)
+				df := su.NewDecodeFilter().
+					ComposeNamespace(&types.NamespaceFilter{
+						Slug: "base_namespace",
+					}).
+					ComposeModule(&types.ModuleFilter{
+						NamespaceID: ns.ID,
+						Handle:      "base_module",
+					})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				n, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
+				req.NoError(err)
 
-		// 		mod, err := store.LookupComposeModuleByNamespaceIDHandle(ctx, s, n.ID, "base_module")
-		// 		req.NoError(err)
-		// 		mff, _, err := store.SearchComposeModuleFields(ctx, s, types.ModuleFieldFilter{
-		// 			ModuleID: []uint64{mod.ID},
-		// 		})
-		// 		req.NoError(err)
+				mod, err := store.LookupComposeModuleByNamespaceIDHandle(ctx, s, n.ID, "base_module")
+				req.NoError(err)
+				mff, _, err := store.SearchComposeModuleFields(ctx, s, types.ModuleFieldFilter{
+					ModuleID: []uint64{mod.ID},
+				})
+				req.NoError(err)
 
-		// 		// Module stuff
-		// 		req.Equal("base module", mod.Name)
-		// 		req.Equal("base_module", mod.Handle)
-		// 		req.Equal(n.ID, mod.NamespaceID)
-		// 		req.Equal(createdAt.Format(time.RFC3339), n.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), n.UpdatedAt.Format(time.RFC3339))
+				// Module stuff
+				req.Equal("base module", mod.Name)
+				req.Equal("base_module", mod.Handle)
+				req.Equal(n.ID, mod.NamespaceID)
+				req.Equal(createdAt.Format(time.RFC3339), n.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), n.UpdatedAt.Format(time.RFC3339))
 
-		// 		// Module fields
-		// 		f := mff.FindByName("module_field_string")
-		// 		req.Equal(mod.ID, f.ModuleID)
-		// 		req.Equal(0, f.Place)
-		// 		req.Equal("String", f.Kind)
-		// 		req.Equal("module_field_string", f.Name)
-		// 		req.Equal("module field string", f.Label)
-		// 		req.Equal(true, f.Private)
-		// 		req.Equal(true, f.Required)
-		// 		req.Equal(true, f.Visible)
-		// 		req.Equal(true, f.Multi)
-		// 		req.Equal("opt_value_1", f.Options["opt1"])
+				// Module fields
+				f := mff.FindByName("module_field_string")
+				req.Equal(mod.ID, f.ModuleID)
+				req.Equal(0, f.Place)
+				req.Equal("String", f.Kind)
+				req.Equal("module_field_string", f.Name)
+				req.Equal("module field string", f.Label)
+				req.Equal(true, f.Private)
+				req.Equal(true, f.Required)
+				req.Equal(true, f.Visible)
+				req.Equal(true, f.Multi)
+				req.Equal("opt_value_1", f.Options["opt1"])
 
-		// 		f = mff.FindByName("module_field_number")
-		// 		req.Equal(mod.ID, f.ModuleID)
-		// 		req.Equal(1, f.Place)
-		// 		req.Equal("Number", f.Kind)
-		// 		req.Equal("module_field_number", f.Name)
-		// 		req.Equal("module field number", f.Label)
-		// 		req.Equal(false, f.Private)
-		// 		req.Equal(false, f.Required)
-		// 		req.Equal(false, f.Visible)
-		// 		req.Equal(false, f.Multi)
-		// 		req.Equal("opt_value_1", f.Options["opt1"])
-		// 	},
-		// },
+				f = mff.FindByName("module_field_number")
+				req.Equal(mod.ID, f.ModuleID)
+				req.Equal(1, f.Place)
+				req.Equal("Number", f.Kind)
+				req.Equal("module_field_number", f.Name)
+				req.Equal("module field number", f.Label)
+				req.Equal(false, f.Private)
+				req.Equal(false, f.Required)
+				req.Equal(false, f.Visible)
+				req.Equal(false, f.Multi)
+				req.Equal("opt_value_1", f.Options["opt1"])
+			},
+		},
 
-		// {
-		// 	name: "base page",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		ns := sTestComposeNamespace(ctx, t, s, "base")
-		// 		sTestComposePage(ctx, t, s, ns.ID, "base")
+		{
+			name: "base page",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				ns := sTestComposeNamespace(ctx, t, s, "base")
+				sTestComposePage(ctx, t, s, ns.ID, "base")
 
-		// 		df := su.NewDecodeFilter().
-		// 			ComposeNamespace(&types.NamespaceFilter{
-		// 				Slug: "base_namespace",
-		// 			}).
-		// 			ComposePage(&types.PageFilter{
-		// 				NamespaceID: ns.ID,
-		// 				Handle:      "base_page",
-		// 			})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		n, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
-		// 		req.NoError(err)
+				df := su.NewDecodeFilter().
+					ComposeNamespace(&types.NamespaceFilter{
+						Slug: "base_namespace",
+					}).
+					ComposePage(&types.PageFilter{
+						NamespaceID: ns.ID,
+						Handle:      "base_page",
+					})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				n, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
+				req.NoError(err)
 
-		// 		pg, err := store.LookupComposePageByNamespaceIDHandle(ctx, s, n.ID, "base_page")
-		// 		req.NoError(err)
+				pg, err := store.LookupComposePageByNamespaceIDHandle(ctx, s, n.ID, "base_page")
+				req.NoError(err)
 
-		// 		// Page
-		// 		req.Equal(n.ID, pg.NamespaceID)
-		// 		req.Equal("base_page", pg.Handle)
-		// 		req.Equal("base page", pg.Title)
-		// 		req.Equal("description", pg.Description)
-		// 		req.Equal(true, pg.Visible)
-		// 		req.Equal(0, pg.Weight)
-		// 		req.Len(pg.Blocks, 2)
-		// 		req.Equal(createdAt.Format(time.RFC3339), pg.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), pg.UpdatedAt.Format(time.RFC3339))
+				// Page
+				req.Equal(n.ID, pg.NamespaceID)
+				req.Equal("base_page", pg.Handle)
+				req.Equal("base page", pg.Title)
+				req.Equal("description", pg.Description)
+				req.Equal(true, pg.Visible)
+				req.Equal(0, pg.Weight)
+				req.Len(pg.Blocks, 2)
+				req.Equal(createdAt.Format(time.RFC3339), pg.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), pg.UpdatedAt.Format(time.RFC3339))
 
-		// 		// Blocks
-		// 		b := pg.Blocks[0]
-		// 		req.Equal("page block content", b.Title)
-		// 		req.Equal("description", b.Description)
-		// 		req.Equal("Content", b.Kind)
+				// Blocks
+				b := pg.Blocks[0]
+				req.Equal("page block content", b.Title)
+				req.Equal("description", b.Description)
+				req.Equal("Content", b.Kind)
 
-		// 		b = pg.Blocks[1]
-		// 		req.Equal("page block qwerty", b.Title)
-		// 		req.Equal("description", b.Description)
-		// 		req.Equal("Qwerty", b.Kind)
-		// 	},
-		// },
+				b = pg.Blocks[1]
+				req.Equal("page block qwerty", b.Title)
+				req.Equal("description", b.Description)
+				req.Equal("Qwerty", b.Kind)
+			},
+		},
 
-		// {
-		// 	name: "base chart",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		ns := sTestComposeNamespace(ctx, t, s, "base")
-		// 		mod := sTestComposeModule(ctx, t, s, ns.ID, "base")
-		// 		sTestComposeChart(ctx, t, s, ns.ID, mod.ID, "base")
+		{
+			name: "base chart",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				ns := sTestComposeNamespace(ctx, t, s, "base")
+				mod := sTestComposeModule(ctx, t, s, ns.ID, "base")
+				sTestComposeChart(ctx, t, s, ns.ID, mod.ID, "base")
 
-		// 		df := su.NewDecodeFilter().
-		// 			ComposeNamespace(&types.NamespaceFilter{
-		// 				Slug: "base_namespace",
-		// 			}).
-		// 			ComposeModule(&types.ModuleFilter{
-		// 				NamespaceID: ns.ID,
-		// 				Handle:      "base_module",
-		// 			}).
-		// 			ComposeChart(&types.ChartFilter{
-		// 				NamespaceID: ns.ID,
-		// 				Handle:      "base_chart",
-		// 			})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		ns, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
-		// 		req.NoError(err)
-		// 		mod, err := store.LookupComposeModuleByNamespaceIDHandle(ctx, s, ns.ID, "base_module")
-		// 		req.NoError(err)
+				df := su.NewDecodeFilter().
+					ComposeNamespace(&types.NamespaceFilter{
+						Slug: "base_namespace",
+					}).
+					ComposeModule(&types.ModuleFilter{
+						NamespaceID: ns.ID,
+						Handle:      "base_module",
+					}).
+					ComposeChart(&types.ChartFilter{
+						NamespaceID: ns.ID,
+						Handle:      "base_chart",
+					})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				ns, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
+				req.NoError(err)
+				mod, err := store.LookupComposeModuleByNamespaceIDHandle(ctx, s, ns.ID, "base_module")
+				req.NoError(err)
 
-		// 		chr, err := store.LookupComposeChartByNamespaceIDHandle(ctx, s, ns.ID, "base_chart")
-		// 		req.NoError(err)
+				chr, err := store.LookupComposeChartByNamespaceIDHandle(ctx, s, ns.ID, "base_chart")
+				req.NoError(err)
 
-		// 		req.Equal(ns.ID, chr.NamespaceID)
-		// 		req.Equal("base_chart", chr.Handle)
-		// 		req.Equal("base chart", chr.Name)
-		// 		req.Equal(createdAt.Format(time.RFC3339), chr.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), chr.UpdatedAt.Format(time.RFC3339))
+				req.Equal(ns.ID, chr.NamespaceID)
+				req.Equal("base_chart", chr.Handle)
+				req.Equal("base chart", chr.Name)
+				req.Equal(createdAt.Format(time.RFC3339), chr.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), chr.UpdatedAt.Format(time.RFC3339))
 
-		// 		req.Equal("colorscheme", chr.Config.ColorScheme)
-		// 		req.Len(chr.Config.Reports, 1)
+				req.Equal("colorscheme", chr.Config.ColorScheme)
+				req.Len(chr.Config.Reports, 1)
 
-		// 		r := chr.Config.Reports[0]
-		// 		req.Equal("filter", r.Filter)
-		// 		req.Equal(mod.ID, r.ModuleID)
-		// 	},
-		// },
+				r := chr.Config.Reports[0]
+				req.Equal("filter", r.Filter)
+				req.Equal(mod.ID, r.ModuleID)
 
-		// {
-		// 	name: "base record",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		ns := sTestComposeNamespace(ctx, t, s, "base")
-		// 		mod := sTestComposeModule(ctx, t, s, ns.ID, "base")
-		// 		usr := sTestUser(ctx, t, s, "base")
-		// 		sTestComposeRecord(ctx, t, s, ns.ID, mod.ID, usr.ID)
+				req.Equal("Euro", r.YAxis["label"])
+				req.Equal(true, r.YAxis["beginAtZero"])
+			},
+		},
 
-		// 		df := su.NewDecodeFilter().
-		// 			ComposeNamespace(&types.NamespaceFilter{
-		// 				Slug: "base_namespace",
-		// 			}).
-		// 			ComposeModule(&types.ModuleFilter{
-		// 				NamespaceID: ns.ID,
-		// 				Handle:      "base_module",
-		// 			}).
-		// 			Users(&stypes.UserFilter{
-		// 				Email: "base_user@test.tld",
-		// 			}).
-		// 			ComposeRecord(&types.RecordFilter{
-		// 				NamespaceID: ns.ID,
-		// 				ModuleID:    mod.ID,
-		// 			})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		ns, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
-		// 		req.NoError(err)
-		// 		mod, err := store.LookupComposeModuleByNamespaceIDHandle(ctx, s, ns.ID, "base_module")
-		// 		req.NoError(err)
-		// 		usr, err := store.LookupUserByHandle(ctx, s, "base_user")
-		// 		req.NoError(err)
+		{
+			name: "base record",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				ns := sTestComposeNamespace(ctx, t, s, "base")
+				mod := sTestComposeModule(ctx, t, s, ns.ID, "base")
+				usr := sTestUser(ctx, t, s, "base")
+				sTestComposeRecord(ctx, t, s, ns.ID, mod.ID, usr.ID)
 
-		// 		rr, _, err := store.SearchComposeRecords(ctx, s, mod, types.RecordFilter{
-		// 			ModuleID:    mod.ID,
-		// 			NamespaceID: ns.ID,
-		// 		})
-		// 		req.NoError(err)
-		// 		req.Len(rr, 1)
-		// 		rec := rr[0]
+				df := su.NewDecodeFilter().
+					ComposeNamespace(&types.NamespaceFilter{
+						Slug: "base_namespace",
+					}).
+					ComposeModule(&types.ModuleFilter{
+						NamespaceID: ns.ID,
+						Handle:      "base_module",
+					}).
+					Users(&stypes.UserFilter{
+						Email: "base_user@test.tld",
+					}).
+					ComposeRecord(&types.RecordFilter{
+						NamespaceID: ns.ID,
+						ModuleID:    mod.ID,
+					})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				ns, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
+				req.NoError(err)
+				mod, err := store.LookupComposeModuleByNamespaceIDHandle(ctx, s, ns.ID, "base_module")
+				req.NoError(err)
+				usr, err := store.LookupUserByHandle(ctx, s, "base_user")
+				req.NoError(err)
 
-		// 		req.Equal(ns.ID, rec.NamespaceID)
-		// 		req.Equal(mod.ID, rec.ModuleID)
+				rr, _, err := store.SearchComposeRecords(ctx, s, mod, types.RecordFilter{
+					ModuleID:    mod.ID,
+					NamespaceID: ns.ID,
+				})
+				req.NoError(err)
+				req.Len(rr, 1)
+				rec := rr[0]
 
-		// 		req.Equal(createdAt.Format(time.RFC3339), rec.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), rec.UpdatedAt.Format(time.RFC3339))
-		// 		req.Equal(usr.ID, rec.OwnedBy)
-		// 		req.Equal(usr.ID, rec.CreatedBy)
-		// 		req.Equal(usr.ID, rec.UpdatedBy)
+				req.Equal(ns.ID, rec.NamespaceID)
+				req.Equal(mod.ID, rec.ModuleID)
 
-		// 		req.Len(rec.Values, 2)
-		// 		vv := rec.Values.FilterByName("module_field_string")
-		// 		req.Len(vv, 1)
-		// 		req.Equal("string value", vv[0].Value)
+				req.Equal(createdAt.Format(time.RFC3339), rec.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), rec.UpdatedAt.Format(time.RFC3339))
+				req.Equal(usr.ID, rec.OwnedBy)
+				req.Equal(usr.ID, rec.CreatedBy)
+				req.Equal(usr.ID, rec.UpdatedBy)
 
-		// 		vv = rec.Values.FilterByName("module_field_number")
-		// 		req.Len(vv, 1)
-		// 		req.Equal("10", vv[0].Value)
-		// 	},
-		// },
+				req.Len(rec.Values, 2)
+				vv := rec.Values.FilterByName("module_field_string")
+				req.Len(vv, 1)
+				req.Equal("string value", vv[0].Value)
 
-		// {
-		// 	name: "full value record",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		ns := sTestComposeNamespace(ctx, t, s, "base")
-		// 		mod := sTestComposeModuleFull(ctx, s, t, ns.ID, "base")
-		// 		usr := sTestUser(ctx, t, s, "base")
+				vv = rec.Values.FilterByName("module_field_number")
+				req.Len(vv, 1)
+				req.Equal("10", vv[0].Value)
+			},
+		},
 
-		// 		recID := su.NextID()
-		// 		rec := &types.Record{
-		// 			ID:          recID,
-		// 			NamespaceID: ns.ID,
-		// 			ModuleID:    mod.ID,
+		{
+			name: "full value record",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				ns := sTestComposeNamespace(ctx, t, s, "base")
+				mod := sTestComposeModuleFull(ctx, s, t, ns.ID, "base")
+				usr := sTestUser(ctx, t, s, "base")
 
-		// 			Values: types.RecordValueSet{
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "BoolTrue",
-		// 					Value:    "1",
-		// 				},
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "BoolFalse",
-		// 					Value:    "0",
-		// 				},
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "DateTime",
-		// 					Value:    "2021-01-01T11:10:09Z",
-		// 				},
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "Email",
-		// 					Value:    "test@mail.tld",
-		// 				},
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "Select",
-		// 					Value:    "v1",
-		// 				},
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "Number",
-		// 					Value:    "10.01",
-		// 				},
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "String",
-		// 					Value:    "testing",
-		// 				},
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "Url",
-		// 					Value:    "htts://www.testing.tld",
-		// 				},
-		// 				{
-		// 					RecordID: recID,
-		// 					Name:     "User",
-		// 					Value:    strconv.FormatUint(usr.ID, 10),
-		// 					Ref:      usr.ID,
-		// 				},
-		// 			},
-		// 		}
-		// 		err := store.CreateComposeRecord(ctx, s, mod, rec)
-		// 		if err != nil {
-		// 			t.Fatal(err)
-		// 		}
+				recID := su.NextID()
+				rec := &types.Record{
+					ID:          recID,
+					NamespaceID: ns.ID,
+					ModuleID:    mod.ID,
 
-		// 		df := su.NewDecodeFilter().
-		// 			ComposeNamespace(&types.NamespaceFilter{
-		// 				Slug: "base_namespace",
-		// 			}).
-		// 			ComposeModule(&types.ModuleFilter{
-		// 				NamespaceID: ns.ID,
-		// 				Handle:      "base_module",
-		// 			}).
-		// 			Users(&stypes.UserFilter{
-		// 				Email: "base_user@test.tld",
-		// 			}).
-		// 			ComposeRecord(&types.RecordFilter{
-		// 				NamespaceID: ns.ID,
-		// 				ModuleID:    mod.ID,
-		// 			})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		ns, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
-		// 		req.NoError(err)
-		// 		mod, err := store.LookupComposeModuleByNamespaceIDHandle(ctx, s, ns.ID, "base_module")
-		// 		req.NoError(err)
-		// 		usr, err := store.LookupUserByHandle(ctx, s, "base_user")
-		// 		req.NoError(err)
+					Values: types.RecordValueSet{
+						{
+							RecordID: recID,
+							Name:     "BoolTrue",
+							Value:    "1",
+						},
+						{
+							RecordID: recID,
+							Name:     "BoolFalse",
+							Value:    "0",
+						},
+						{
+							RecordID: recID,
+							Name:     "DateTime",
+							Value:    "2021-01-01T11:10:09Z",
+						},
+						{
+							RecordID: recID,
+							Name:     "Email",
+							Value:    "test@mail.tld",
+						},
+						{
+							RecordID: recID,
+							Name:     "Select",
+							Value:    "v1",
+						},
+						{
+							RecordID: recID,
+							Name:     "Number",
+							Value:    "10.01",
+						},
+						{
+							RecordID: recID,
+							Name:     "String",
+							Value:    "testing",
+						},
+						{
+							RecordID: recID,
+							Name:     "Url",
+							Value:    "htts://www.testing.tld",
+						},
+						{
+							RecordID: recID,
+							Name:     "User",
+							Value:    strconv.FormatUint(usr.ID, 10),
+							Ref:      usr.ID,
+						},
+					},
+				}
+				err := store.CreateComposeRecord(ctx, s, mod, rec)
+				if err != nil {
+					t.Fatal(err)
+				}
 
-		// 		rr, _, err := store.SearchComposeRecords(ctx, s, mod, types.RecordFilter{
-		// 			ModuleID:    mod.ID,
-		// 			NamespaceID: ns.ID,
-		// 		})
-		// 		req.NoError(err)
-		// 		req.Len(rr, 1)
-		// 		rec := rr[0]
+				df := su.NewDecodeFilter().
+					ComposeNamespace(&types.NamespaceFilter{
+						Slug: "base_namespace",
+					}).
+					ComposeModule(&types.ModuleFilter{
+						NamespaceID: ns.ID,
+						Handle:      "base_module",
+					}).
+					Users(&stypes.UserFilter{
+						Email: "base_user@test.tld",
+					}).
+					ComposeRecord(&types.RecordFilter{
+						NamespaceID: ns.ID,
+						ModuleID:    mod.ID,
+					})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				ns, err := store.LookupComposeNamespaceBySlug(ctx, s, "base_namespace")
+				req.NoError(err)
+				mod, err := store.LookupComposeModuleByNamespaceIDHandle(ctx, s, ns.ID, "base_module")
+				req.NoError(err)
+				usr, err := store.LookupUserByHandle(ctx, s, "base_user")
+				req.NoError(err)
 
-		// 		req.Equal("1", rec.Values.FilterByName("BoolTrue")[0].Value)
-		// 		req.Equal("", rec.Values.FilterByName("BoolFalse")[0].Value)
-		// 		req.Equal("2021-01-01T11:10:09Z", rec.Values.FilterByName("DateTime")[0].Value)
-		// 		req.Equal("test@mail.tld", rec.Values.FilterByName("Email")[0].Value)
-		// 		req.Equal("v1", rec.Values.FilterByName("Select")[0].Value)
-		// 		req.Equal("10.01", rec.Values.FilterByName("Number")[0].Value)
-		// 		req.Equal("testing", rec.Values.FilterByName("String")[0].Value)
-		// 		req.Equal("htts://www.testing.tld", rec.Values.FilterByName("Url")[0].Value)
-		// 		req.Equal(strconv.FormatUint(usr.ID, 10), rec.Values.FilterByName("User")[0].Value)
-		// 		req.Equal(usr.ID, rec.Values.FilterByName("User")[0].Ref)
-		// 	},
-		// },
+				rr, _, err := store.SearchComposeRecords(ctx, s, mod, types.RecordFilter{
+					ModuleID:    mod.ID,
+					NamespaceID: ns.ID,
+				})
+				req.NoError(err)
+				req.Len(rr, 1)
+				rec := rr[0]
 
-		// {
-		// 	name: "base roles",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		sTestRole(ctx, t, s, "base")
+				req.Equal("1", rec.Values.FilterByName("BoolTrue")[0].Value)
+				req.Equal("", rec.Values.FilterByName("BoolFalse")[0].Value)
+				req.Equal("2021-01-01T11:10:09Z", rec.Values.FilterByName("DateTime")[0].Value)
+				req.Equal("test@mail.tld", rec.Values.FilterByName("Email")[0].Value)
+				req.Equal("v1", rec.Values.FilterByName("Select")[0].Value)
+				req.Equal("10.01", rec.Values.FilterByName("Number")[0].Value)
+				req.Equal("testing", rec.Values.FilterByName("String")[0].Value)
+				req.Equal("htts://www.testing.tld", rec.Values.FilterByName("Url")[0].Value)
+				req.Equal(strconv.FormatUint(usr.ID, 10), rec.Values.FilterByName("User")[0].Value)
+				req.Equal(usr.ID, rec.Values.FilterByName("User")[0].Ref)
+			},
+		},
 
-		// 		df := su.NewDecodeFilter().
-		// 			Roles(&stypes.RoleFilter{
-		// 				Handle: "base_role",
-		// 			})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		rl, err := store.LookupRoleByHandle(ctx, s, "base_role")
-		// 		req.NoError(err)
+		{
+			name: "base roles",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				sTestRole(ctx, t, s, "base")
 
-		// 		req.Equal("base role", rl.Name)
-		// 		req.Equal("base_role", rl.Handle)
-		// 		req.Equal(createdAt.Format(time.RFC3339), rl.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), rl.UpdatedAt.Format(time.RFC3339))
-		// 	},
-		// },
+				df := su.NewDecodeFilter().
+					Roles(&stypes.RoleFilter{
+						Handle: "base_role",
+					})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				rl, err := store.LookupRoleByHandle(ctx, s, "base_role")
+				req.NoError(err)
 
-		// {
-		// 	name: "base users",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		sTestUser(ctx, t, s, "base")
+				req.Equal("base role", rl.Name)
+				req.Equal("base_role", rl.Handle)
+				req.Equal(createdAt.Format(time.RFC3339), rl.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), rl.UpdatedAt.Format(time.RFC3339))
+			},
+		},
 
-		// 		df := su.NewDecodeFilter().
-		// 			Users(&stypes.UserFilter{
-		// 				Handle: "base_user",
-		// 			})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		usr, err := store.LookupUserByHandle(ctx, s, "base_user")
-		// 		req.NoError(err)
+		{
+			name: "base users",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				sTestUser(ctx, t, s, "base")
 
-		// 		req.Equal("base_user_u", usr.Username)
-		// 		req.Equal("base_user@test.tld", usr.Email)
-		// 		req.Equal("base user", usr.Name)
-		// 		req.Equal("base_user", usr.Handle)
-		// 		req.Equal(stypes.NormalUser, usr.Kind)
-		// 		req.Equal("avatar", usr.Meta.Avatar)
-		// 		req.Equal(true, usr.EmailConfirmed)
-		// 		req.Equal(createdAt.Format(time.RFC3339), usr.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), usr.UpdatedAt.Format(time.RFC3339))
-		// 	},
-		// },
+				df := su.NewDecodeFilter().
+					Users(&stypes.UserFilter{
+						Handle: "base_user",
+					})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				usr, err := store.LookupUserByHandle(ctx, s, "base_user")
+				req.NoError(err)
 
-		// {
-		// 	name: "base templates",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		sTestTemplate(ctx, t, s, "base")
+				req.Equal("base_user_u", usr.Username)
+				req.Equal("base_user@test.tld", usr.Email)
+				req.Equal("base user", usr.Name)
+				req.Equal("base_user", usr.Handle)
+				req.Equal(stypes.NormalUser, usr.Kind)
+				req.Equal("avatar", usr.Meta.Avatar)
+				req.Equal(true, usr.EmailConfirmed)
+				req.Equal(createdAt.Format(time.RFC3339), usr.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), usr.UpdatedAt.Format(time.RFC3339))
+			},
+		},
 
-		// 		df := su.NewDecodeFilter().
-		// 			Templates(&stypes.TemplateFilter{
-		// 				Handle: "base_template",
-		// 			})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		tpl, err := store.LookupTemplateByHandle(ctx, s, "base_template")
-		// 		req.NoError(err)
+		{
+			name: "base templates",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				sTestTemplate(ctx, t, s, "base")
 
-		// 		req.Equal("base_template", tpl.Handle)
-		// 		req.Equal(stypes.DocumentTypeHTML, tpl.Type)
-		// 		req.Equal(true, tpl.Partial)
-		// 		req.Equal("base_short", tpl.Meta.Short)
-		// 		req.Equal("base_description", tpl.Meta.Description)
-		// 		req.Equal("base_template content", tpl.Template)
-		// 		req.Equal(createdAt.Format(time.RFC3339), tpl.CreatedAt.Format(time.RFC3339))
-		// 		req.Equal(updatedAt.Format(time.RFC3339), tpl.UpdatedAt.Format(time.RFC3339))
-		// 	},
-		// },
+				df := su.NewDecodeFilter().
+					Templates(&stypes.TemplateFilter{
+						Handle: "base_template",
+					})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				tpl, err := store.LookupTemplateByHandle(ctx, s, "base_template")
+				req.NoError(err)
+
+				req.Equal("base_template", tpl.Handle)
+				req.Equal(stypes.DocumentTypeHTML, tpl.Type)
+				req.Equal(true, tpl.Partial)
+				req.Equal("base_short", tpl.Meta.Short)
+				req.Equal("base_description", tpl.Meta.Description)
+				req.Equal("base_template content", tpl.Template)
+				req.Equal(createdAt.Format(time.RFC3339), tpl.CreatedAt.Format(time.RFC3339))
+				req.Equal(updatedAt.Format(time.RFC3339), tpl.UpdatedAt.Format(time.RFC3339))
+			},
+		},
 
 		{
 			name: "base applications",
@@ -543,87 +551,87 @@ func TestStoreYaml_base(t *testing.T) {
 			},
 		},
 
-		// {
-		// 	name: "base settings",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		usr := sTestUser(ctx, t, s, "base")
-		// 		sTestSettings(ctx, t, s, usr.ID, "base")
+		{
+			name: "base settings",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				usr := sTestUser(ctx, t, s, "base")
+				sTestSettings(ctx, t, s, usr.ID, "base")
 
-		// 		df := su.NewDecodeFilter().
-		// 			Users(&stypes.UserFilter{
-		// 				Handle: "base_user",
-		// 			}).
-		// 			Settings(&stypes.SettingsFilter{})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		usr, err := store.LookupUserByHandle(ctx, s, "base_user")
-		// 		req.NoError(err)
+				df := su.NewDecodeFilter().
+					Users(&stypes.UserFilter{
+						Handle: "base_user",
+					}).
+					Settings(&stypes.SettingsFilter{})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				usr, err := store.LookupUserByHandle(ctx, s, "base_user")
+				req.NoError(err)
 
-		// 		ss, _, err := store.SearchSettings(ctx, s, stypes.SettingsFilter{})
-		// 		req.NoError(err)
-		// 		req.Len(ss, 2)
+				ss, _, err := store.SearchSettings(ctx, s, stypes.SettingsFilter{})
+				req.NoError(err)
+				req.Len(ss, 2)
 
-		// 		sv := ss[0]
-		// 		req.Equal("base_setting_1", sv.Name)
-		// 		req.Equal("10", sv.Value.String())
-		// 		req.Equal(updatedAt.Format(time.RFC3339), sv.UpdatedAt.Format(time.RFC3339))
-		// 		req.Equal(usr.ID, sv.UpdatedBy)
+				sv := ss[0]
+				req.Equal("base_setting_1", sv.Name)
+				req.Equal("10", sv.Value.String())
+				req.Equal(updatedAt.Format(time.RFC3339), sv.UpdatedAt.Format(time.RFC3339))
+				req.Equal(usr.ID, sv.UpdatedBy)
 
-		// 		sv = ss[1]
-		// 		req.Equal("base_setting_2", sv.Name)
-		// 		req.Equal("20", sv.Value.String())
-		// 		req.Equal(updatedAt.Format(time.RFC3339), sv.UpdatedAt.Format(time.RFC3339))
-		// 		req.Equal(usr.ID, sv.UpdatedBy)
-		// 	},
-		// },
+				sv = ss[1]
+				req.Equal("base_setting_2", sv.Name)
+				req.Equal("20", sv.Value.String())
+				req.Equal(updatedAt.Format(time.RFC3339), sv.UpdatedAt.Format(time.RFC3339))
+				req.Equal(usr.ID, sv.UpdatedBy)
+			},
+		},
 
-		// {
-		// 	name: "base rbac",
-		// 	pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
-		// 		rl := sTestRole(ctx, t, s, "base")
-		// 		sTestRbac(ctx, t, s, rl.ID)
+		{
+			name: "base rbac",
+			pre: func(ctx context.Context, s store.Storer) (error, *su.DecodeFilter) {
+				rl := sTestRole(ctx, t, s, "base")
+				sTestRbac(ctx, t, s, rl.ID)
 
-		// 		df := su.NewDecodeFilter().
-		// 			Roles(&stypes.RoleFilter{
-		// 				Handle: "base_role",
-		// 			}).
-		// 			Rbac(&rbac.RuleFilter{})
-		// 		return nil, df
-		// 	},
-		// 	check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
-		// 		rl, err := store.LookupRoleByHandle(ctx, s, "base_role")
-		// 		req.NoError(err)
+				df := su.NewDecodeFilter().
+					Roles(&stypes.RoleFilter{
+						Handle: "base_role",
+					}).
+					Rbac(&rbac.RuleFilter{})
+				return nil, df
+			},
+			check: func(ctx context.Context, s store.Storer, req *require.Assertions) {
+				rl, err := store.LookupRoleByHandle(ctx, s, "base_role")
+				req.NoError(err)
 
-		// 		rr, _, err := store.SearchRbacRules(ctx, s, rbac.RuleFilter{})
-		// 		req.NoError(err)
-		// 		req.Len(rr, 4)
+				rr, _, err := store.SearchRbacRules(ctx, s, rbac.RuleFilter{})
+				req.NoError(err)
+				req.Len(rr, 4)
 
-		// 		rr.Walk(func(r *rbac.Rule) error {
-		// 			rs := r.Resource.String()
-		// 			switch true {
-		// 			case rs == "compose":
-		// 				req.Equal(rl.ID, r.RoleID)
-		// 				req.Equal("read", r.Operation.String())
-		// 				req.Equal(rbac.Allow, r.Access)
-		// 			case rs == "system":
-		// 				req.Equal(rl.ID, r.RoleID)
-		// 				req.Equal("read", r.Operation.String())
-		// 				req.Equal(rbac.Deny, r.Access)
-		// 			case rs == "system:role:*":
-		// 				req.Equal(rl.ID, r.RoleID)
-		// 				req.Equal("read", r.Operation.String())
-		// 				req.Equal(rbac.Deny, r.Access)
-		// 			default:
-		// 				req.Equal(rl.ID, r.RoleID)
-		// 				req.Equal(fmt.Sprintf("system:role:%d", rl.ID), r.Resource.String())
-		// 				req.Equal("read", r.Operation.String())
-		// 				req.Equal(rbac.Deny, r.Access)
-		// 			}
-		// 			return nil
-		// 		})
-		// 	},
-		// },
+				rr.Walk(func(r *rbac.Rule) error {
+					rs := r.Resource.String()
+					switch true {
+					case rs == "compose":
+						req.Equal(rl.ID, r.RoleID)
+						req.Equal("read", r.Operation.String())
+						req.Equal(rbac.Allow, r.Access)
+					case rs == "system":
+						req.Equal(rl.ID, r.RoleID)
+						req.Equal("read", r.Operation.String())
+						req.Equal(rbac.Deny, r.Access)
+					case rs == "system:role:*":
+						req.Equal(rl.ID, r.RoleID)
+						req.Equal("read", r.Operation.String())
+						req.Equal(rbac.Deny, r.Access)
+					default:
+						req.Equal(rl.ID, r.RoleID)
+						req.Equal(fmt.Sprintf("system:role:%d", rl.ID), r.Resource.String())
+						req.Equal("read", r.Operation.String())
+						req.Equal(rbac.Deny, r.Access)
+					}
+					return nil
+				})
+			},
+		},
 	}
 
 	for _, c := range cases {
diff --git a/tests/envoy/testdata/base/charts_axis.yaml b/tests/envoy/testdata/base/charts_axis.yaml
new file mode 100644
index 000000000..f272db4cd
--- /dev/null
+++ b/tests/envoy/testdata/base/charts_axis.yaml
@@ -0,0 +1,27 @@
+namespace: ns1
+charts:
+  c1:
+    name: c1 name
+    config:
+      reports:
+      - dimensions:
+        - conditions: {}
+          field: Rating
+          meta: {}
+          modifier: (no grouping / buckets)
+          skipMissing: true
+        filter: ""
+        metrics:
+        - aggregate: AVG
+          field: count
+          fill: true
+          fixTooltips: false
+          label: Number of Accounts
+          lineTension: 0.4
+          type: line
+        module: mod1
+        renderer: {}
+        yAxis:
+          beginAtZero: true
+          label: Euro
+      colorScheme: tableau.Tableau10
diff --git a/tests/envoy/yaml_store_base_test.go b/tests/envoy/yaml_store_base_test.go
index 264562ecc..5fb42f495 100644
--- a/tests/envoy/yaml_store_base_test.go
+++ b/tests/envoy/yaml_store_base_test.go
@@ -206,6 +206,31 @@ func TestYamlStore_base(t *testing.T) {
 			},
 		},
 
+		{
+			name: "charts; axis",
+			file: "charts_axis",
+			pre: func() (err error) {
+				return collect(
+					storeComposeNamespace(ctx, s, 100, "ns1"),
+					storeComposeModule(ctx, s, 100, 200, "mod1"),
+				)
+			},
+			check: func(req *require.Assertions) {
+				chr, err := store.LookupComposeChartByNamespaceIDHandle(ctx, s, 100, "c1")
+				req.NoError(err)
+				req.NotNil(chr)
+
+				req.Equal("c1", chr.Handle)
+				req.Equal("c1 name", chr.Name)
+
+				req.Len(chr.Config.Reports, 1)
+
+				rep := chr.Config.Reports[0]
+				req.Equal("Euro", rep.YAxis["label"])
+				req.Equal(true, rep.YAxis["beginAtZero"])
+			},
+		},
+
 		{
 			name: "pages; no namespace",
 			file: "pages_no_ns",