Steps
- Record the route, scoped identity, permitted data class, and prior mapping.
- Send synthetic input and retain the response and timestamp.
- Test an identity or data class that must be denied.
- Restore the prior route if the test is not approved.
Verify and rollback
The allowed response and denied result match policy, with a rollback reference retained.