feat: select governed workflow scope targets

tests/test_governance.py

@@ -13,6 +13,7 @@ from govoplan_workflow.backend.db.models import (
     WorkflowDefinition,
     WorkflowDefinitionRevision,
 )
+from govoplan_workflow.backend.governance import normalize_definition_scope
 from govoplan_workflow.backend.schemas import (
     WorkflowDefinitionCreateRequest,
     WorkflowDefinitionDeriveRequest,
@@ -167,6 +168,19 @@ class WorkflowGovernanceTests(unittest.TestCase):
         )
         self.assertFalse(response.governance.automation_runtime_available)
 
+    def test_user_scope_normalizes_membership_to_account_id(self) -> None:
+        tenant_id, scope_type, scope_id, scope_key = normalize_definition_scope(
+            self.principal,
+            scope_type="user",
+            scope_id="membership-1",
+            administrative=False,
+        )
+
+        self.assertEqual("tenant-1", tenant_id)
+        self.assertEqual("user", scope_type)
+        self.assertEqual("account-1", scope_id)
+        self.assertEqual("user:account-1", scope_key)
+
     def test_template_cannot_be_activated(self) -> None:
         template = create_definition(
             self.session,