Directory integration is reported as 'configured fine': the engineer tested it once with his own elevated directory account and proposes signing off the access work. The acceptance reviewer pushes back. What is missing from the evidence?

Directory acceptance evidence is only worth what it covers, and a single test with the engineer's own elevated account covers the least interesting half. The meaningful proof comes from an ordinary operator account and covers two layers: that the directory authenticates the user, and that group-to-role mapping grants precisely the limited reach that operator should have - a privileged test account can succeed for the wrong reasons, authenticating while masking a mapping error that could hand the real operator the wrong powers or none. 'One login proves it for everyone' treats authentication as a system-wide switch; in a role-mapped integration the per-user result depends on group membership and mapping rules, hence per-role-class testing as the acceptance standard. A confirmation login on the built-in account exercises the local authentication stack and cannot prove the directory path - the built-in account exists precisely so administration can proceed without the directory. 'A member of all groups covers all mappings' compounds the flaw: membership in the union proves nothing about whether each individual group maps to the right role, and the union is itself the over-reach the review is hunting. Exam caveat: acceptance should also include a negative case - a directory user outside every mapped group must be refused. Operational check: an operator-class account, an audit-class account and an unmapped user all attempt login, and the three outcomes are recorded.