Steps

  1. Record the route, scoped identity, permitted data class, and prior mapping.
  2. Send synthetic input and retain the response and timestamp.
  3. Test an identity or data class that must be denied.
  4. Restore the prior route if the test is not approved.

Verify and rollback

The allowed response and denied result match policy, with a rollback reference retained.