Prove access with an allow and a deny

Use the connected agent to make two safe test requests: one the group is allowed to make and one it is not allowed to make. Choose test data that is safe to access. A denied request should stop before the external operation runs.

Open Audit Logs and confirm both requests have a decision record. Check the actor, operation, resource, and decision. Audit records contain redacted metadata; keep credentials and customer data in your environment.

Check it worked

You can find one allow and one deny for the agent in Audit Logs. If a request is denied unexpectedly, check workspace selection, group membership, the applicable policy, and runtime troubleshooting.