Test the boundary before agents act.

• Identify the agent, delegating principal and tenant on every request.
• List permitted actions and resources for each task. Set when the grant expires.
• Test valid requests, cross-tenant requests, expired grants and unknown tools.

• Show reviewers the resource, action and parameters they are authorising.
• Try modifying the amount or resource after approval, approving with an unauthorised identity, and submitting an expired or used approval again.
• Confirm the tool stays blocked until the executor validates a matching approval.

• From the agent environment, call the tool directly using every credential the agent can access.
• Repeat through another endpoint or MCP connection, and change tool descriptions or names.
• Simulate an unavailable policy service and verify that sensitive actions fail closed.

For an allowed call, denied call and approval, check that the record identifies the actor, rule and action, and whether the tool ultimately executed. Redact credentials and sensitive values before recording request data.