Prove the tool is blocked before launch.

Test both business behavior and the security boundary. A “denied” response is insufficient unless you also prove the sensitive function did not execute.

1. Use a staging key

Create a separate key restricted to staging agent IDs. Never run adversarial tests against production customer data.

2. Add an execution witness

executions = []

def customer_delete(customer_id: str) -> str:
    executions.append(customer_id)
    return "deleted"

# After a denied request:
assert executions == []

3. Minimum test matrix

4. Review evidence

Dashboard → Decisions should show agent ID, action, decision, reason code and request ID. Approvals and incidents should preserve the same operational context.

What this does not prove

Local tests do not prove that an unwrapped tool, leaked credential or unrestricted network client is safe. Review architecture and use gateway enforcement for critical operations.