Scenario matrix
Include cases that:- complete without intervention
- request additional user input
- require an exact approval
- require a provider connection
- require payment review
- fail because authority is insufficient
- encounter temporary provider unavailability
- are retried with the same
requestId - are stopped while queued or running
Useful measures
Assert safety behavior
Test that stale approvals fail closed, updates do not imply approval, foreign Action IDs remain inaccessible, and provider credentials never appear in responses or logs. Separate product-quality failures from transport failures. A200 response with approval_required is a valid state, not successful completion.