Do: prove an unauthorized identity or data class is denied before using real material. Example: let a fictional analyst role request a restricted row and retain the denial status and reason. Check: confirm no sensitive value appears in the response or logs, then test the allowed synthetic row separately; a successful request alone is not boundary evidence.