Check whether the outcome improved
Write the scope matrix
Write expected results for an allowed read, the target operation, another restricted operation, a different tenant, and an expired credential. Include status and safe error expectations. Keep resource identifiers synthetic and make the matrix explicit enough for a reviewer to spot accidental privilege growth.
Exercise neighboring resources
Execute the matrix against the same environment and client revision. Compare scope claims, selected resource, response code, and local handling. Confirm that a missing scope is not converted into a retry, default resource, or success state by the integration.
Recheck after scope removal
Remove the newly required scope, restore it, and repeat the target operation. Test a stale token and a wrong audience without printing secrets. Check audit or correlation records for the same request identity, then retain the fixtures and policy revision used for the result.
What to carry forward
Accept the change when the target operation works only with the intended scope and resource, neighboring access remains denied, and failures are legible. Keep the gate open for untested tenants or environments. Record the matrix, policy revision, redaction boundary, and remaining authority assumptions.
Technical background: OpenAI documentation.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow