Prove the policy does what you think.
Authorization is the one part of an application where a false permit is a breach and a false denial is an outage. It deserves better than a handful of integration tests that assert a 403.
1. What this enforces
Nothing in production. This is the discipline that makes a policy change safe to make: assertions about specific decisions, property tests about invariants that must hold for all inputs, replay against recorded traffic, mutation testing to find rules no test actually exercises, and a coverage measure over the policy rather than over the code.
2. Where it enforces
In the test suite and in CI, evaluating the same policy the runtime evaluates. A test harness with its own copy of the rules tests the copy.
3. What evidence it produces
Coverage over policy, which is the number nobody currently has. Line coverage says the check ran; policy coverage says which branches of authority were ever tested.
4. Why you cannot assemble this from what you already own
Integration tests cover the paths someone thought of. A policy engine’s own test tooling evaluates its rules, not the in-process context and aggregates B5 decides on. Mutation testing is the only technique that reliably finds a rule that no test would notice removing.
5. What Q4 2026 adds
Authorization Testing Framework
Assertions, decision matrices, property tests, mutation tests, historical replay and authorization coverage reporting.
6. Acceptance criteria
The specification defines this capability against the three baseline criteria that apply to every Q4 2026 extension — documentation with failure modes and a runbook, automated coverage of primary and abuse cases, and telemetry that emits evidence without exposing prohibited data. Capability-specific criteria have not been written yet, and this page will state them when they are rather than inventing them now.
- The capability is documented with configuration, failure modes, security implications and an operational runbook.
- Automated unit, integration, negative and regression tests cover the primary and abuse cases.
- Telemetry and audit evidence are emitted without exposing prohibited sensitive data.
7. What is still open
The following are genuinely undecided rather than merely undocumented, and each one changes what the capability is:
- What policy coverage means precisely — rules exercised, branches, or principal-resource pairs.
- Whether replay uses production evidence, and the privacy handling that follows if it does.
- Whether a coverage floor can gate a deployment.
Every Q4 2026 extension is also held to four platform-wide requirements, six test classes and four release gates. They are published once, on the Q4 2026 roadmap, rather than repeated on every page.
Talk to a human.
Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.