diff --git a/changelog.d/4-docs/revert-wpb8628 b/changelog.d/4-docs/revert-wpb8628
new file mode 100644
index 00000000000..4400ff6154a
--- /dev/null
+++ b/changelog.d/4-docs/revert-wpb8628
@@ -0,0 +1 @@
+Re-introduce test case tags for BSI audit (revert #4041)
\ No newline at end of file
diff --git a/integration/test/Test/AccessUpdate.hs b/integration/test/Test/AccessUpdate.hs
index ad2f12a978b..c63c10cbd0b 100644
--- a/integration/test/Test/AccessUpdate.hs
+++ b/integration/test/Test/AccessUpdate.hs
@@ -38,6 +38,7 @@ testBaz :: HasCallStack => App ()
 testBaz = pure ()
 -}
 
+-- | @SF.Federation @SF.Separation @TSFI.RESTfulAPI @S2
 --
 -- The test asserts that, among others, remote users are removed from a
 -- conversation when an access update occurs that disallows guests from
@@ -73,6 +74,8 @@ testAccessUpdateGuestRemoved = do
     res.status `shouldMatchInt` 200
     res.json %. "members.others.0.qualified_id" `shouldMatch` objQidObject bob
 
+-- @END
+
 testAccessUpdateGuestRemovedUnreachableRemotes :: (HasCallStack) => App ()
 testAccessUpdateGuestRemovedUnreachableRemotes = do
   resourcePool <- asks resourcePool
diff --git a/integration/test/Test/Login.hs b/integration/test/Test/Login.hs
index 096f441a50f..56ded5e6026 100644
--- a/integration/test/Test/Login.hs
+++ b/integration/test/Test/Login.hs
@@ -23,6 +23,7 @@ testLoginVerify6DigitEmailCodeSuccess = do
   bindResponse (loginWith2ndFactor owner email defPassword code) $ \resp -> do
     resp.status `shouldMatchInt` 200
 
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that login fails with wrong second factor email verification code
 testLoginVerify6DigitWrongCodeFails :: (HasCallStack) => App ()
@@ -38,6 +39,9 @@ testLoginVerify6DigitWrongCodeFails = do
     resp.status `shouldMatchInt` 403
     resp.json %. "label" `shouldMatch` "code-authentication-failed"
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that login without verification code fails if SndFactorPasswordChallenge feature is enabled in team
 testLoginVerify6DigitMissingCodeFails :: (HasCallStack) => App ()
@@ -50,6 +54,9 @@ testLoginVerify6DigitMissingCodeFails = do
     resp.status `shouldMatchInt` 403
     resp.json %. "label" `shouldMatch` "code-authentication-required"
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that login fails with expired second factor email verification code
 testLoginVerify6DigitExpiredCodeFails :: (HasCallStack) => App ()
@@ -73,6 +80,8 @@ testLoginVerify6DigitExpiredCodeFails = do
         resp.status `shouldMatchInt` 403
         resp.json %. "label" `shouldMatch` "code-authentication-failed"
 
+-- @END
+
 testLoginVerify6DigitResendCodeSuccessAndRateLimiting :: (HasCallStack) => App ()
 testLoginVerify6DigitResendCodeSuccessAndRateLimiting = do
   (owner, team, []) <- createTeam OwnDomain 0
diff --git a/libs/zauth/test/ZAuth.hs b/libs/zauth/test/ZAuth.hs
index db94845d04c..80545f884ae 100644
--- a/libs/zauth/test/ZAuth.hs
+++ b/libs/zauth/test/ZAuth.hs
@@ -56,7 +56,7 @@ tests = do
           ],
         testGroup
           "Signing and Verifying"
-          [ testCase "testExpired - expired" (runCreate z 1 $ testExpired v),
+          [ testCase "expired" (runCreate z 1 $ testExpired v),
             testCase "not expired" (runCreate z 2 $ testNotExpired v),
             testCase "signed access-token is valid" (runCreate z 3 $ testSignAndVerify v)
           ],
@@ -94,6 +94,7 @@ testNotExpired p = do
   liftIO $ assertBool "testNotExpired: validation failed" (isRight x)
 
 -- The testExpired test conforms to the following testing standards:
+-- @SF.Channel @TSFI.RESTfulAPI @TSFI.NTP @S2 @S3
 --
 -- Using an expired access token should fail
 testExpired :: V.Env -> Create ()
@@ -104,6 +105,8 @@ testExpired p = do
   x <- liftIO $ runValidate p $ check t
   liftIO $ Left Expired @=? x
 
+-- @END
+
 testSignAndVerify :: V.Env -> Create ()
 testSignAndVerify p = do
   u <- liftIO nextRandom
diff --git a/services/brig/test/integration/API/User/Account.hs b/services/brig/test/integration/API/User/Account.hs
index 5cd1538a79d..b041300dca0 100644
--- a/services/brig/test/integration/API/User/Account.hs
+++ b/services/brig/test/integration/API/User/Account.hs
@@ -100,6 +100,7 @@ tests _ at opts p b c ch g aws userJournalWatcher =
   testGroup
     "account"
     [ test p "post /register - 201 (with preverified)" $ testCreateUserWithPreverified opts b userJournalWatcher,
+      test p "testCreateUserWithInvalidVerificationCode - post /register - 400 (with preverified)" $ testCreateUserWithInvalidVerificationCode b,
       test p "post /register - 201" $ testCreateUser b g,
       test p "post /register - 201 anonymous" $ testCreateUserAnon b g,
       test p "testCreateUserEmptyName - post /register - 400 empty name" $ testCreateUserEmptyName b,
@@ -160,6 +161,25 @@ tests _ at opts p b c ch g aws userJournalWatcher =
         ]
     ]
 
+-- The testCreateUserWithInvalidVerificationCode test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- Registering with an invalid verification code and valid account details should fail.
+testCreateUserWithInvalidVerificationCode :: Brig -> Http ()
+testCreateUserWithInvalidVerificationCode brig = do
+  -- Attempt to register (pre verified) user with email
+  e <- randomEmail
+  code <- randomActivationCode -- incorrect but syntactically valid activation code
+  let Object regEmail =
+        object
+          [ "name" .= Name "Alice",
+            "email" .= fromEmail e,
+            "email_code" .= code
+          ]
+  postUserRegister' regEmail brig !!! const 404 === statusCode
+
+-- @END
+
 testUpdateUserEmailByTeamOwner :: Opt.Opts -> Brig -> Http ()
 testUpdateUserEmailByTeamOwner opts brig = do
   (_, teamOwner, emailOwner : otherTeamMember : _) <- createPopulatedBindingTeamWithNamesAndHandles brig 2
@@ -270,6 +290,7 @@ assertOnlySelfConversations galley uid = do
     liftIO $ cnvType conv @?= SelfConv
 
 -- The testCreateUserEmptyName test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- An empty name is not allowed on registration
 testCreateUserEmptyName :: Brig -> Http ()
@@ -281,7 +302,10 @@ testCreateUserEmptyName brig = do
   post (brig . path "/register" . contentJson . body p)
     !!! const 400 === statusCode
 
+-- @END
+
 -- The testCreateUserLongName test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- a name with > 128 characters is not allowed.
 testCreateUserLongName :: Brig -> Http ()
@@ -294,6 +318,8 @@ testCreateUserLongName brig = do
   post (brig . path "/register" . contentJson . body p)
     !!! const 400 === statusCode
 
+-- @END
+
 testCreateUserAnon :: Brig -> Galley -> Http ()
 testCreateUserAnon brig galley = do
   let p =
@@ -351,6 +377,7 @@ testCreateUserPending _ brig = do
   Search.assertCan'tFind brig suid quid "Mr. Pink"
 
 -- The testCreateUserConflict test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- email address must not be taken on @/register@.
 testCreateUserConflict :: Opt.Opts -> Brig -> Http ()
@@ -382,7 +409,10 @@ testCreateUserConflict _ brig = do
     const 409 === statusCode
     const (Just "key-exists") === fmap Error.label . responseJsonMaybe
 
+-- @END
+
 -- The testCreateUserInvalidEmail test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- Test to make sure a new user cannot be created with an invalid email address or invalid phone number.
 testCreateUserInvalidEmail :: Opt.Opts -> Brig -> Http ()
@@ -412,6 +442,8 @@ testCreateUserInvalidEmail _ brig = do
   post (brig . path "/register" . contentJson . body reqPhone)
     !!! const 400 === statusCode
 
+-- @END
+
 testCreateUserBlacklist :: Opt.Opts -> Brig -> AWS.Env -> Http ()
 testCreateUserBlacklist (Opt.setRestrictUserCreation . Opt.optSettings -> Just True) _ _ = pure ()
 testCreateUserBlacklist _ brig aws =
diff --git a/services/brig/test/integration/API/User/Auth.hs b/services/brig/test/integration/API/User/Auth.hs
index a2e34731214..2dbf722c596 100644
--- a/services/brig/test/integration/API/User/Auth.hs
+++ b/services/brig/test/integration/API/User/Auth.hs
@@ -376,6 +376,7 @@ testLoginUntrustedDomain brig = do
     !!! const 200 === statusCode
 
 -- The testLoginFailure test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- Test that trying to log in with a wrong password or non-existent email fails.
 testLoginFailure :: Brig -> Http ()
@@ -397,6 +398,8 @@ testLoginFailure brig = do
     PersistentCookie
     !!! const 403 === statusCode
 
+-- @END
+
 testThrottleLogins :: Opts.Opts -> Brig -> Http ()
 testThrottleLogins conf b = do
   -- Get the maximum amount of times we are allowed to login before
@@ -422,6 +425,7 @@ testThrottleLogins conf b = do
   login b (defEmailLogin e) SessionCookie !!! const 200 === statusCode
 
 -- The testLimitRetries test conforms to the following testing standards:
+-- @SF.Channel @TSFI.RESTfulAPI @TSFI.NTP @S2
 --
 -- The following test tests the login retries. It checks that a user can make
 -- only a prespecified number of attempts to log in with an invalid password,
@@ -476,6 +480,8 @@ testLimitRetries conf brig = do
   liftIO $ threadDelay (1000000 * 2)
   login brig (defEmailLogin email) SessionCookie !!! const 200 === statusCode
 
+-- @END
+
 -------------------------------------------------------------------------------
 -- LegalHold Login
 
@@ -602,6 +608,7 @@ testNoUserSsoLogin brig = do
 -- Token Refresh
 
 -- The testInvalidCookie test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @TSFI.NTP @S2
 --
 -- Test that invalid and expired tokens do not work.
 testInvalidCookie :: forall u. (ZAuth.UserTokenLike u) => ZAuth.Env -> Brig -> Http ()
@@ -619,6 +626,8 @@ testInvalidCookie z b = do
     const 403 === statusCode
     const (Just "expired") =~= responseBody
 
+-- @END
+
 testInvalidToken :: ZAuth.Env -> Brig -> Http ()
 testInvalidToken z b = do
   user <- Public.userId <$> randomUser b
@@ -1131,6 +1140,7 @@ testRemoveCookiesByLabelAndId b = do
   listCookies b (userId u) >>= liftIO . ([lbl] @=?) . map cookieLabel
 
 -- The testTooManyCookies test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- The test asserts that there is an upper limit for the number of user cookies
 -- per cookie type. It does that by concurrently attempting to create more
@@ -1180,6 +1190,8 @@ testTooManyCookies config b = do
             )
         xxx -> error ("Unexpected status code when logging in: " ++ show xxx)
 
+-- @END
+
 testLogout :: Brig -> Http ()
 testLogout b = do
   Just email <- userEmail <$> randomUser b
diff --git a/services/brig/test/integration/API/User/Client.hs b/services/brig/test/integration/API/User/Client.hs
index 3fc750c12ce..4cc3d7e9648 100644
--- a/services/brig/test/integration/API/User/Client.hs
+++ b/services/brig/test/integration/API/User/Client.hs
@@ -162,6 +162,7 @@ testAddGetClientVerificationCode db brig galley = do
     const 200 === statusCode
     const (Just c) === responseJsonMaybe
 
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that device cannot be added with missing second factor email verification code when this feature is enabled
 testAddGetClientMissingCode :: Brig -> Galley -> Http ()
@@ -178,6 +179,9 @@ testAddGetClientMissingCode brig galley = do
     const 403 === statusCode
     const (Just "code-authentication-required") === fmap Error.label . responseJsonMaybe
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that device cannot be added with wrong second factor email verification code when this feature is enabled
 testAddGetClientWrongCode :: Brig -> Galley -> Http ()
@@ -195,6 +199,9 @@ testAddGetClientWrongCode brig galley = do
     const 403 === statusCode
     const (Just "code-authentication-failed") === fmap Error.label . responseJsonMaybe
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that device cannot be added with expired second factor email verification code when this feature is enabled
 testAddGetClientCodeExpired :: DB.ClientState -> Opt.Opts -> Brig -> Galley -> Http ()
@@ -218,6 +225,8 @@ testAddGetClientCodeExpired db opts brig galley = do
     const 403 === statusCode
     const (Just "code-authentication-failed") === fmap Error.label . responseJsonMaybe
 
+-- @END
+
 data AddGetClient = AddGetClient
   { addWithPassword :: Bool,
     addWithMLSKeys :: Bool
@@ -895,6 +904,7 @@ testMultiUserGetPrekeysQualifiedV4 brig opts = do
       const (Right $ expectedUserClientMap) === responseJsonEither
 
 -- The testTooManyClients test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- The test validates the upper bound on the number of permanent clients per
 -- user. It does so by trying to create one permanent client more than allowed.
@@ -975,7 +985,10 @@ testRegularPrekeysCannotBeSentAsLastPrekeysDuringUpdate brig = do
     !!! const 400
       === statusCode
 
+-- @END
+
 -- The testRemoveClient test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- This test validates creating and deleting a client. A client is created and
 -- consequently deleted. Deleting a second time yields response 404 not found.
@@ -1021,7 +1034,10 @@ testRemoveClient hasPwd brig cannon = do
           newClientCookie = Just defCookieLabel
         }
 
+-- @END
+
 -- The testRemoveClientShortPwd test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- The test checks if a client can be deleted by providing a too short password.
 -- This is done by using a single-character password, whereas the minimum is 6
@@ -1054,7 +1070,10 @@ testRemoveClientShortPwd brig = do
           newClientCookie = Just defCookieLabel
         }
 
+-- @END
+
 -- The testRemoveClientIncorrectPwd test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- The test checks if a client can be deleted by providing a syntax-valid, but
 -- incorrect password. The client deletion attempt fails with a 403 error
@@ -1087,6 +1106,8 @@ testRemoveClientIncorrectPwd brig = do
           newClientCookie = Just defCookieLabel
         }
 
+-- @END
+
 testUpdateClient :: Opt.Opts -> Brig -> Http ()
 testUpdateClient opts brig = do
   uid <- userId <$> randomUser brig
@@ -1279,6 +1300,7 @@ testMissingClient brig = do
         . responseHeaders
 
 -- The testAddMultipleTemporary test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 -- Legacy (galley)
 --
 -- Add temporary client, check that all services (both galley and
@@ -1336,6 +1358,8 @@ testAddMultipleTemporary brig galley cannon = do
             . zUser u
       pure $ Vec.length <$> (preview _Array =<< responseJsonMaybe @Value r)
 
+-- @END
+
 testPreKeyRace :: Brig -> Http ()
 testPreKeyRace brig = do
   uid <- userId <$> randomUser brig
diff --git a/services/brig/test/integration/API/User/Handles.hs b/services/brig/test/integration/API/User/Handles.hs
index db34f2f9277..8da3c774ef2 100644
--- a/services/brig/test/integration/API/User/Handles.hs
+++ b/services/brig/test/integration/API/User/Handles.hs
@@ -69,6 +69,7 @@ tests _cl _at conf p b c g =
     ]
 
 -- The next line contains a mapping from the testHandleUpdate test to the following test standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
 -- The test validates various updates to the user's handle. First, it attempts
 -- to set invalid handles. This fails. Then it successfully sets a valid handle.
@@ -139,6 +140,8 @@ testHandleUpdate brig cannon = do
   put (brig . path "/self/handle" . contentJson . zUser uid2 . zConn "c" . body update)
     !!! const 200 === statusCode
 
+-- @END
+
 testHandleRace :: Brig -> Http ()
 testHandleRace brig = do
   us <- replicateM 10 (userId <$> randomUser brig)
diff --git a/services/federator/test/integration/Test/Federator/IngressSpec.hs b/services/federator/test/integration/Test/Federator/IngressSpec.hs
index 2165edb0761..babbaca3a43 100644
--- a/services/federator/test/integration/Test/Federator/IngressSpec.hs
+++ b/services/federator/test/integration/Test/Federator/IngressSpec.hs
@@ -75,6 +75,7 @@ spec env = do
 
   it "testRejectRequestsWithoutClientCertIngress" (testRejectRequestsWithoutClientCertIngress env)
 
+-- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
 --
 -- This test was primarily intended to test that federator is using the API right (header
 -- name etc.), but it is also effectively testing that federator rejects clients without
@@ -110,6 +111,8 @@ testRejectRequestsWithoutClientCertIngress env = runTestFederator env $ do
         expectationFailure "Expected client certificate error, got remote error"
       Left (RemoteErrorResponse _ _ status _) -> status `shouldBe` HTTP.status400
 
+-- @END
+
 liftToCodensity :: (Member (Embed (Codensity IO)) r) => Sem (Embed IO ': r) a -> Sem r a
 liftToCodensity = runEmbedded @IO @(Codensity IO) lift
 
diff --git a/services/federator/test/integration/Test/Federator/InwardSpec.hs b/services/federator/test/integration/Test/Federator/InwardSpec.hs
index 85980f8948c..1daee8e77e4 100644
--- a/services/federator/test/integration/Test/Federator/InwardSpec.hs
+++ b/services/federator/test/integration/Test/Federator/InwardSpec.hs
@@ -112,11 +112,17 @@ spec env =
 
     it "testRejectRequestsWithoutClientCertInward" (testRejectRequestsWithoutClientCertInward env)
 
+-- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
+--
 -- This test is covered by the unit tests 'validateDomainCertWrongDomain' because
 -- the domain matching is checked on certificate validation.
 testShouldRejectMissmatchingOriginDomainInward :: TestEnv -> IO ()
 testShouldRejectMissmatchingOriginDomainInward env = runTestFederator env $ pure ()
 
+-- @END
+
+-- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
+--
 -- See related tests in unit tests (for matching client certificates against domain names)
 -- and "IngressSpec".
 testRejectRequestsWithoutClientCertInward :: TestEnv -> IO ()
@@ -129,6 +135,8 @@ testRejectRequestsWithoutClientCertInward env = runTestFederator env $ do
     (encode hdl)
     !!! const 400 === statusCode
 
+-- @END
+
 inwardCallWithHeaders ::
   (MonadIO m, MonadHttp m, MonadReader TestEnv m, HasCallStack) =>
   ByteString ->
diff --git a/services/federator/test/unit/Test/Federator/ExternalServer.hs b/services/federator/test/unit/Test/Federator/ExternalServer.hs
index ac45f5aae2d..93af2e8ba9c 100644
--- a/services/federator/test/unit/Test/Federator/ExternalServer.hs
+++ b/services/federator/test/unit/Test/Federator/ExternalServer.hs
@@ -256,6 +256,8 @@ requestNoCertificate =
       assertEqual "no calls to any service should be made" [] serviceCalls
       pure Wai.ResponseReceived
 
+-- @SF.Federation @TSFI.Federate @TSFI.DNS @S2 @S3 @S7
+-- Reject request if the client certificate for federator is invalid
 requestInvalidCertificate :: TestTree
 requestInvalidCertificate =
   testCase "testRequestInvalidCertificate - should fail with a 404 when an invalid certificate is given" $ do
@@ -274,6 +276,8 @@ requestInvalidCertificate =
       assertEqual "no calls to any service should be made" [] serviceCalls
       pure Wai.ResponseReceived
 
+-- @END
+
 testInvalidPaths :: TestTree
 testInvalidPaths = do
   let invalidPaths =
diff --git a/services/federator/test/unit/Test/Federator/InternalServer.hs b/services/federator/test/unit/Test/Federator/InternalServer.hs
index 66706b74f68..db91bf3dfe9 100644
--- a/services/federator/test/unit/Test/Federator/InternalServer.hs
+++ b/services/federator/test/unit/Test/Federator/InternalServer.hs
@@ -112,6 +112,7 @@ federatedRequestSuccess =
     body <- Wai.lazyResponseBody res
     body @?= "\"bar\""
 
+-- @SF.Federation @TSFI.Federate @TSFI.DNS @S2 @S3 @S7
 --
 -- Refuse to send outgoing request to non-included domain when AllowDynamic is configured.
 federatedRequestFailureAllowList :: TestTree
@@ -154,3 +155,5 @@ federatedRequestFailureAllowList =
         . interpretMetricsEmpty
         $ callOutward targetDomain Brig (RPC "get-user-by-handle") request undefined
     eith @?= Left (FederationDenied targetDomain)
+
+-- @END
diff --git a/services/federator/test/unit/Test/Federator/Options.hs b/services/federator/test/unit/Test/Federator/Options.hs
index bece8365ab0..137b6d411e5 100644
--- a/services/federator/test/unit/Test/Federator/Options.hs
+++ b/services/federator/test/unit/Test/Federator/Options.hs
@@ -163,6 +163,8 @@ testSettings =
             assertFailure "expected failure for invalid private key, got success"
     ]
 
+-- @SF.Federation @TSFI.Federate @S3 @S7
+--
 failToStartWithInvalidServerCredentials :: IO ()
 failToStartWithInvalidServerCredentials = do
   let settings =
@@ -186,6 +188,8 @@ failToStartWithInvalidServerCredentials = do
     Right _ ->
       assertFailure "expected failure for invalid client certificate, got success"
 
+-- @END
+
 assertParsesAs :: (HasCallStack, Eq a, FromJSON a, Show a) => a -> ByteString -> Assertion
 assertParsesAs v bs =
   assertEqual "YAML parsing" (Right v) $
diff --git a/services/federator/test/unit/Test/Federator/Remote.hs b/services/federator/test/unit/Test/Federator/Remote.hs
index 0a8b92e432a..9409a0c9f45 100644
--- a/services/federator/test/unit/Test/Federator/Remote.hs
+++ b/services/federator/test/unit/Test/Federator/Remote.hs
@@ -130,6 +130,7 @@ testValidatesCertificateSuccess =
             Right _ -> assertFailure "Congratulations, you fixed a known issue!"
     ]
 
+-- @SF.Federation @TSFI.Federate @TSFI.DNS @S2
 --
 -- This is a group of test cases where refusing to connect with the server is
 -- checked. The second test case refuses to connect with a server when the
@@ -155,6 +156,8 @@ testValidatesCertificateWrongHostname =
             Right _ -> assertFailure "Expected connection with the server to fail"
     ]
 
+-- @END
+
 testConnectionError :: TestTree
 testConnectionError = testCase "connection failures are reported correctly" $ do
   tlsSettings <- mkTLSSettingsOrThrow settings
diff --git a/services/federator/test/unit/Test/Federator/Validation.hs b/services/federator/test/unit/Test/Federator/Validation.hs
index bd2c882c0e7..1a36f2f6644 100644
--- a/services/federator/test/unit/Test/Federator/Validation.hs
+++ b/services/federator/test/unit/Test/Federator/Validation.hs
@@ -115,6 +115,7 @@ federateWithAllowListFail =
         $ ensureCanFederateWith (Domain "hello.world")
     assertBool "federating should not be allowed" (isLeft eith)
 
+-- @SF.Federation @TSFI.Federate @TSFI.DNS @S2 @S3 @S7
 --
 -- Refuse to send outgoing request to non-included domain when AllowDynamic is configured.
 validateDomainAllowListFail :: TestTree
@@ -132,6 +133,8 @@ validateDomainAllowListFail =
         $ validateDomain exampleCert (Domain "localhost.example.com")
     res @?= Left (FederationDenied (Domain "localhost.example.com"))
 
+-- @END
+
 validateDomainAllowListSuccess :: TestTree
 validateDomainAllowListSuccess =
   testCase "should give parsed domain if in the allow list" $ do
@@ -148,6 +151,7 @@ validateDomainAllowListSuccess =
         $ validateDomain exampleCert domain
     assertEqual "validateDomain should give 'localhost.example.com' as domain" domain res
 
+-- @SF.Federation @TSFI.Federate @TSFI.DNS @S3 @S7
 --
 -- Reject request if the infrastructure domain in the client cert does not match the backend
 -- domain in the `Wire-origin-domain` header.
@@ -165,6 +169,8 @@ validateDomainCertWrongDomain =
         $ validateDomain exampleCert (Domain "foo.example.com")
     res @?= Left (AuthenticationFailure (pure [X509.NameMismatch "foo.example.com"]))
 
+-- @END
+
 validateDomainCertCN :: TestTree
 validateDomainCertCN =
   testCase "should succeed if the certificate has subject CN but no SAN" $ do
@@ -247,9 +253,12 @@ validateDomainNonIdentitySRV =
         $ validateDomain exampleCert domain
     res @?= domain
 
+-- @SF.Federation @TSFI.Federate @TSFI.DNS @S2 @S3 @S7
 -- Reject request if the client certificate for federator is invalid
 validateDomainCertInvalid :: TestTree
 validateDomainCertInvalid =
   testCase "validateDomainCertInvalid - should fail if the client certificate is invalid" $ do
     let res = decodeCertificate "not a certificate"
     res @?= Left "no certificate found"
+
+-- @END
diff --git a/services/galley/test/integration/API.hs b/services/galley/test/integration/API.hs
index 2a6c1f3a8bf..f05541d3a76 100644
--- a/services/galley/test/integration/API.hs
+++ b/services/galley/test/integration/API.hs
@@ -408,6 +408,7 @@ postConvWithUnreachableRemoteUsers rbs = do
         groupConvs
     WS.assertNoEvent (3 # Second) [wsAlice, wsAlex]
 
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies whether a message actually gets sent all the way to
 -- cannon.
 postCryptoMessageVerifyMsgSentAndRejectIfMissingClient :: TestM ()
@@ -496,6 +497,9 @@ postCryptoMessageVerifyMsgSentAndRejectIfMissingClient = do
       liftIO $ assertBool "unexpected equal clients" (bc /= bc2)
       assertNoMsg wsB2 (wsAssertOtr qconv qalice ac bc cipher)
 
+-- @END
+
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies basic mismatch behavior of the the JSON endpoint.
 postCryptoMessageVerifyRejectMissingClientAndRespondMissingPrekeysJson :: TestM ()
 postCryptoMessageVerifyRejectMissingClientAndRespondMissingPrekeysJson = do
@@ -521,6 +525,9 @@ postCryptoMessageVerifyRejectMissingClientAndRespondMissingPrekeysJson = do
     Map.keys (userClientMap (getUserClientPrekeyMap p)) @=? [eve]
     Map.keys <$> Map.lookup eve (userClientMap (getUserClientPrekeyMap p)) @=? Just [ec]
 
+-- @END
+
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies basic mismatch behaviour of the protobuf endpoint.
 postCryptoMessageVerifyRejectMissingClientAndRespondMissingPrekeysProto :: TestM ()
 postCryptoMessageVerifyRejectMissingClientAndRespondMissingPrekeysProto = do
@@ -548,6 +555,8 @@ postCryptoMessageVerifyRejectMissingClientAndRespondMissingPrekeysProto = do
     Map.keys (userClientMap (getUserClientPrekeyMap p)) @=? [eve]
     Map.keys <$> Map.lookup eve (userClientMap (getUserClientPrekeyMap p)) @=? Just [ec]
 
+-- @END
+
 -- | This test verifies behaviour when an unknown client posts the message. Only
 -- tests the Protobuf endpoint.
 postCryptoMessageNotAuthorizeUnknownClient :: TestM ()
@@ -563,6 +572,7 @@ postCryptoMessageNotAuthorizeUnknownClient = do
   postProtoOtrMessage alice (ClientId 0x172618352518396) conv m
     !!! const 403 === statusCode
 
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies the following scenario.
 -- A client sends a message to all clients of a group and one more who is not part of the group.
 -- The server must not send this message to client ids not part of the group.
@@ -588,6 +598,9 @@ postMessageClientNotInGroupDoesNotReceiveMsg = do
     checkEveGetsMsg
     checkChadDoesNotGetMsg
 
+-- @END
+
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies that when a client sends a message not to all clients of a group then the server should reject the message and sent a notification to the sender (412 Missing clients).
 -- The test is somewhat redundant because this is already tested as part of other tests already. This is a stand alone test that solely tests the behavior described above.
 postMessageRejectIfMissingClients :: TestM ()
@@ -615,6 +628,9 @@ postMessageRejectIfMissingClients = do
     mkMsg :: ByteString -> (UserId, ClientId) -> (UserId, ClientId, Text)
     mkMsg text (uid, clientId) = (uid, clientId, toBase64Text text)
 
+-- @END
+
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies behaviour under various values of ignore_missing and
 -- report_missing. Only tests the JSON endpoint.
 postCryptoMessageVerifyCorrectResponseIfIgnoreAndReportMissingQueryParam :: TestM ()
@@ -672,6 +688,9 @@ postCryptoMessageVerifyCorrectResponseIfIgnoreAndReportMissingQueryParam = do
   where
     listToByteString = BS.intercalate "," . map toByteString'
 
+-- @END
+
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- Sets up a conversation on Backend A known as "owning backend". One of the
 -- users from Backend A will send the message but have a missing client. It is
 -- expected that the message will not be sent.
@@ -732,6 +751,8 @@ postMessageQualifiedLocalOwningBackendMissingClients = do
       assertMismatchQualified mempty expectedMissing mempty mempty mempty
     WS.assertNoEvent (1 # Second) [wsBob, wsChad]
 
+-- @END
+
 -- | Sets up a conversation on Backend A known as "owning backend". One of the
 -- users from Backend A will send the message, it is expected that message will
 -- be sent successfully.
@@ -822,6 +843,7 @@ postMessageQualifiedLocalOwningBackendRedundantAndDeletedClients = do
       -- Wait less for no message
       WS.assertNoEvent (1 # Second) [wsNonMember]
 
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- Sets up a conversation on Backend A known as "owning backend". One of the
 -- users from Backend A will send the message but have a missing client. It is
 -- expected that the message will be sent except when it is specifically
@@ -948,6 +970,8 @@ postMessageQualifiedLocalOwningBackendIgnoreMissingClients = do
       assertMismatchQualified mempty expectedMissing mempty mempty mempty
     WS.assertNoEvent (1 # Second) [wsBob, wsChad]
 
+-- @END
+
 postMessageQualifiedLocalOwningBackendFailedToSendClients :: TestM ()
 postMessageQualifiedLocalOwningBackendFailedToSendClients = do
   -- WS receive timeout
@@ -1177,6 +1201,7 @@ testPostCodeRejectedIfGuestLinksDisabled = do
   setStatus Public.FeatureStatusEnabled
   checkPostCode 200
 
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- Check if guests cannot join anymore if guest invite feature was disabled on team level
 testJoinTeamConvGuestLinksDisabled :: TestM ()
 testJoinTeamConvGuestLinksDisabled = do
@@ -1234,6 +1259,8 @@ testJoinTeamConvGuestLinksDisabled = do
   postJoinCodeConv bob' cCode !!! const 200 === statusCode
   checkFeatureStatus Public.FeatureStatusEnabled
 
+-- @END
+
 testJoinNonTeamConvGuestLinksDisabled :: TestM ()
 testJoinNonTeamConvGuestLinksDisabled = do
   let convName = "testConversation"
@@ -1257,6 +1284,7 @@ testJoinNonTeamConvGuestLinksDisabled = do
     const (Right (ConversationCoverView convId (Just convName) False)) === responseJsonEither
     const 200 === statusCode
 
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test case covers a negative check that if access code of a guest link is revoked no further
 -- people can join the group conversation. Additionally it covers:
 -- Random users can use invite link
@@ -1311,6 +1339,8 @@ postJoinCodeConvOk = do
     putQualifiedAccessUpdate alice qconv noCodeAccess !!! const 200 === statusCode
     postJoinCodeConv dave payload !!! const 404 === statusCode
 
+-- @END
+
 postJoinCodeConvWithPassword :: TestM ()
 postJoinCodeConvWithPassword = do
   alice <- randomUser
diff --git a/services/galley/test/integration/API/Federation.hs b/services/galley/test/integration/API/Federation.hs
index abd5bfccac8..4fc71a761d5 100644
--- a/services/galley/test/integration/API/Federation.hs
+++ b/services/galley/test/integration/API/Federation.hs
@@ -159,6 +159,7 @@ getConversationsAllFound = do
       (Just (sort [bob, qUnqualified carlQ]))
       (fmap (sort . map (qUnqualified . omQualifiedId) . (.members.others)) c2)
 
+-- @SF.Federation @TSFI.RESTfulAPI @S2
 --
 -- The test asserts that via a federation client a user cannot fetch
 -- conversation details of a conversation they are not part of: they get an
@@ -187,6 +188,8 @@ getConversationsNotPartOf = do
       GetConversationsRequest rando [qUnqualified . cnvQualifiedId $ cnv1]
   liftIO $ assertEqual "conversation list not empty" [] convs
 
+-- @END
+
 onConvCreated :: TestM ()
 onConvCreated = do
   c <- view tsCannon
diff --git a/services/galley/test/integration/API/Teams.hs b/services/galley/test/integration/API/Teams.hs
index cad9536576d..8aca27809c2 100644
--- a/services/galley/test/integration/API/Teams.hs
+++ b/services/galley/test/integration/API/Teams.hs
@@ -1044,6 +1044,7 @@ testDeleteTeamVerificationCodeSuccess = do
       const 202 === statusCode
   assertTeamDelete 10 "team delete, should be there" tid
 
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that team cannot be deleted with missing second factor email verification code when this feature is enabled
 testDeleteTeamVerificationCodeMissingCode :: TestM ()
@@ -1065,6 +1066,9 @@ testDeleteTeamVerificationCodeMissingCode = do
       const 403 === statusCode
       const "code-authentication-required" === (Error.label . responseJsonUnsafeWithMsg "error label")
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that team cannot be deleted with expired second factor email verification code when this feature is enabled
 testDeleteTeamVerificationCodeExpiredCode :: TestM ()
@@ -1089,6 +1093,9 @@ testDeleteTeamVerificationCodeExpiredCode = do
       const 403 === statusCode
       const "code-authentication-failed" === (Error.label . responseJsonUnsafeWithMsg "error label")
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2
 --
 -- Test that team cannot be deleted with wrong second factor email verification code when this feature is enabled
 testDeleteTeamVerificationCodeWrongCode :: TestM ()
@@ -1111,6 +1118,8 @@ testDeleteTeamVerificationCodeWrongCode = do
       const 403 === statusCode
       const "code-authentication-failed" === (Error.label . responseJsonUnsafeWithMsg "error label")
 
+-- @END
+
 setFeatureLockStatus :: forall cfg. (KnownSymbol (Public.FeatureSymbol cfg)) => TeamId -> Public.LockStatus -> TestM ()
 setFeatureLockStatus tid status = do
   g <- viewGalley
@@ -1388,6 +1397,7 @@ testBillingInLargeTeam = do
   assertTeamUpdate ("delete fanoutLimit + 3rd billing member: " <> show ownerFanoutPlusThree) team (fanoutLimit + 2) (allOwnersBeforeFanoutLimit <> [ownerFanoutPlusTwo])
   refreshIndex
 
+-- | @SF.Management @TSFI.RESTfulAPI @S2
 -- This test covers:
 -- Promotion, demotion of team roles.
 -- Demotion by superior roles is allowed.
@@ -1454,6 +1464,8 @@ testUpdateTeamMember = do
       e ^. eventTeam @?= tid
       e ^. eventData @?= EdMemberUpdate uid mPerm
 
+-- @END
+
 testUpdateTeamStatus :: TestM ()
 testUpdateTeamStatus = do
   g <- viewGalley
diff --git a/services/spar/test-integration/Test/Spar/APISpec.hs b/services/spar/test-integration/Test/Spar/APISpec.hs
index d953b064fa8..07670e1d3f4 100644
--- a/services/spar/test-integration/Test/Spar/APISpec.hs
+++ b/services/spar/test-integration/Test/Spar/APISpec.hs
@@ -293,6 +293,7 @@ specFinalizeLogin = do
             authnresp <- runSimpleSP $ mkAuthnResponse privcreds idp3 spmeta authnreq True
             loginSuccess =<< submitAuthnResponse tid3 authnresp
 
+      -- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
       -- Do not authenticate if SSO IdP response is for different team
       context "rejectsSAMLResponseInWrongTeam" $ do
         it "fails" $ do
@@ -319,6 +320,8 @@ specFinalizeLogin = do
             authnresp <- runSimpleSP $ mkAuthnResponseWithSubj subj privcreds idp2 spmeta authnreq True
             loginFailure =<< submitAuthnResponse tid2 authnresp
 
+      -- @END
+
       context "user is created once, then deleted in team settings, then can login again." $ do
         it "responds with 'allowed'" $ do
           (ownerid, teamid) <- callCreateUserWithTeam
@@ -1662,6 +1665,7 @@ specReAuthSsoUserWithPassword =
 ----------------------------------------------------------------------
 -- tests for bsi audit
 
+-- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
 testRejectsSAMLResponseSayingAccessNotGranted :: TestSpar ()
 testRejectsSAMLResponseSayingAccessNotGranted = do
   (user, tid) <- callCreateUserWithTeam
@@ -1683,6 +1687,10 @@ testRejectsSAMLResponseSayingAccessNotGranted = do
     bdy `shouldContain` "}, receiverOrigin)"
     hasPersistentCookieHeader sparresp `shouldBe` Left "no set-cookie header"
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+--
 -- Do not authenticate if SSO IdP response is for unknown issuer
 testRejectsSAMLResponseFromWrongIssuer :: TestSpar ()
 testRejectsSAMLResponseFromWrongIssuer = do
@@ -1707,6 +1715,10 @@ testRejectsSAMLResponseFromWrongIssuer = do
     submitaresp
     checkresp
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+--
 -- Do not authenticate if SSO IdP response is signed with wrong key
 testRejectsSAMLResponseSignedWithWrongKey :: TestSpar ()
 testRejectsSAMLResponseSignedWithWrongKey = do
@@ -1724,6 +1736,10 @@ testRejectsSAMLResponseSignedWithWrongKey = do
       checkresp sparresp = statusCode sparresp `shouldBe` 400
   checkSamlFlow mkareq mkaresp submitaresp checkresp
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+--
 -- Do not authenticate if SSO IdP response has no corresponding request anymore
 testRejectsSAMLResponseIfRequestIsStale :: TestSpar ()
 testRejectsSAMLResponseIfRequestIsStale = do
@@ -1739,6 +1755,10 @@ testRejectsSAMLResponseIfRequestIsStale = do
         (cs . fromJust . responseBody $ sparresp) `shouldContain` "bad InResponseTo attribute(s)"
   checkSamlFlow mkareq mkaresp submitaresp checkresp
 
+-- @END
+
+-- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+--
 -- Do not authenticate if SSO IdP response is gone missing
 testRejectsSAMLResponseIfResponseIsStale :: TestSpar ()
 testRejectsSAMLResponseIfResponseIsStale = do
@@ -1752,6 +1772,8 @@ testRejectsSAMLResponseIfResponseIsStale = do
         (cs . fromJust . responseBody $ sparresp) `shouldContain` "<title>wire:sso:error:forbidden</title>"
   checkSamlFlow mkareq mkaresp submitaresp checkresp
 
+-- @END
+
 ----------------------------------------------------------------------
 -- Helpers
 
diff --git a/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs b/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
index 0d9ace470ec..69a064400cf 100644
--- a/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
@@ -106,6 +106,8 @@ testCreateToken = do
   listUsers_ (Just token) (Just fltr) (env ^. teSpar)
     !!! const 200 === statusCode
 
+-- @SF.Channel @TSFI.RESTfulAPI @S2
+--
 -- Test positive case but also that a SCIM token cannot be created with wrong
 -- or missing second factor email verification code when this feature is enabled
 testCreateTokenWithVerificationCode :: TestSpar ()
@@ -141,6 +143,8 @@ testCreateTokenWithVerificationCode = do
       call $
         post (brig . paths ["verification-code", "send"] . contentJson . json (Public.SendVerificationCode action email))
 
+-- @END
+
 unlockFeature :: GalleyReq -> TeamId -> TestSpar ()
 unlockFeature galley tid =
   call $ put (galley . paths ["i", "teams", toByteString' tid, "features", featureNameBS @Public.SndFactorPasswordChallengeConfig, toByteString' Public.LockStatusUnlocked]) !!! const 200 === statusCode
@@ -219,6 +223,7 @@ testNumIdPs = do
   createToken_ owner (CreateScimToken "drei" (Just defPassword) Nothing) (env ^. teSpar)
     !!! checkErr 400 (Just "more-than-one-idp")
 
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 -- Test that a token can only be created as a team owner
 testCreateTokenAuthorizesOnlyAdmins :: TestSpar ()
 testCreateTokenAuthorizesOnlyAdmins = do
@@ -251,6 +256,8 @@ testCreateTokenAuthorizesOnlyAdmins = do
   (mkUser RoleAdmin >>= createToken')
     !!! const 200 === statusCode
 
+-- @END
+
 -- | Test that for a user with a password, token creation requires reauthentication (i.e. the
 -- field @"password"@ should be provided).
 --
@@ -449,6 +456,7 @@ testDeletedTokensAreUnlistable = do
 ----------------------------------------------------------------------------
 -- Miscellaneous tests
 
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 -- This test verifies that the SCIM API responds with an authentication error
 -- and can't be used if it receives an invalid secret token
 -- or if no token is provided at all
@@ -460,3 +468,5 @@ testAuthIsNeeded = do
   listUsers_ (Just invalidToken) Nothing (env ^. teSpar) !!! checkErr 401 Nothing
   -- Try to do @GET /Users@ without a token and check that it fails
   listUsers_ Nothing Nothing (env ^. teSpar) !!! checkErr 401 Nothing
+
+-- @END
diff --git a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
index 4ac175f5afb..e138bc76db5 100644
--- a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
@@ -840,6 +840,9 @@ testExternalIdIsRequired = do
   createUser_ (Just tok) user' (env ^. teSpar)
     !!! const 400 === statusCode
 
+-- The next line contains a mapping from this test to the following test standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
 -- Test that user creation fails if handle is invalid
 testCreateRejectsInvalidHandle :: TestSpar ()
 testCreateRejectsInvalidHandle = do
@@ -850,6 +853,8 @@ testCreateRejectsInvalidHandle = do
   createUser_ (Just tok) (user {Scim.User.userName = "#invalid name"}) (env ^. teSpar)
     !!! const 400 === statusCode
 
+-- @END
+
 -- | Test that user creation fails if handle is already in use (even on different team).
 testCreateRejectsTakenHandle :: TestSpar ()
 testCreateRejectsTakenHandle = do