Staging tests for a licensing API currently cover only successful authenticated requests. What else must they include?
Select an answer to reveal the explanation.
Short Explanation
Happy paths lie by omission. Staging should also throw bad tokens and garbage bodies to prove the licensing API fails closed. Turning off authorizers to avoid seeing errors just trains false confidence.
Full Explanation
Testing deployed applications includes negative cases: unauthorized or expired tokens, malformed payloads, and other validation failures. Those checks confirm authorizers and request validation behave correctly before promotion. Limiting tests to HTTP 200, waiting for production incidents, or disabling auth in staging undermines Domain 3 quality gates for civic APIs.