Refuse an unentitled caller in a Forge resolver, and prove it with a test that goes red without the gate Key takeaways END STATE: a resolver that refuses an unentitled caller, proven by a test suite that scores 1/6 against the ungated version and 6/6 against the gated one. The happy path passes either way. That is why a positive-only test proves nothing about authorization. Fail CLOSED: a probe that throws, times out, or returns an unexpected shape must refuse, not allow. ...