Editorial review pendingon version support under review
Action boundary
Before you act
- Expected result
- An allowlist binds each synthetic actor to a purpose, approved operations, expiry, owner, and revocation path.
- Failure mode
- A display name, phone contact, or unverified header is treated as authority.
- Rollback
- Remove the pending identity from the test allowlist and seek the provider-specific verification receipt.
Orient
A friendly name is a label. Authority comes from a verified provider identity and a policy that says what it may do.
Perform
For each test actor record the stable provider ID, purpose, allowed operation, destination scope, consent basis, expiry, owner, and revocation method. Keep credentials out of the record.
Check
Test a message with the correct display name and a different stable ID. The policy outcome must be drop or hold, never delivery.
Provider gate
Telegram, WhatsApp, Discord, and generic webhooks have different identity and verification mechanisms. Do not copy a pattern between them. Capture the current official provider documentation and have a reviewer confirm the exact test configuration before enabling a real adapter.
Continue
Use only approved identities as inputs to the routing matrix in Lesson 3.1.
Lesson checkpoint
Ready to move on?
Mark this lesson complete when you can apply its outcome without relying on the examples above.