Access-control tests must exercise the real registry and permissive drift
Access-control tests should exercise the committed registry and deliberately permissive configuration drift, alongside isolated fixtures. A fixture with an admin-only allowlist can pass while the deployed registry independently grants standard callers access. Place mandatory sour…