AI Agent Authorization Testing: 12 Denied-Action Cases

Authorization is proven by what the system refuses. Run these cases at the execution boundary and require a denial before any downstream side effect.

Negative test set

1. Valid user requests another tenant's resource ID.
2. Valid agent invokes an unassigned tool.
3. Read scope requests a write action.
4. Approved action changes destination or material parameters.
5. Approval expires before execution.
6. Approver lacks authority for the resource.
7. Workload identity is revoked while work is queued.
8. Token audience targets another MCP server.
9. Inbound client token is forwarded to an upstream API.
10. Nested tool call requests broader scope than the parent plan.
11. Retry occurs after an ambiguous side effect.
12. Evidence collector is unavailable for a high-impact action.

Required result

Each test should preserve subject, delegator, tenant, workspace, agent and workflow version, requested capability, resource, policy version, decision, reason, and confirmation that the connector did not execute. Treat a timeout or missing log as a failed test, not a pass.

Regression gate

Run the suite whenever identity, roles, tool catalog, policy engine, gateway, approval flow, or retry code changes. Add every real incident as a permanent denied-action regression.

Start from the BlueBear authorization tuple.