Escalate a major violation; confirm an authorized human can disable the
agent's ServiceNow machine identity from the escalation view.
After disabling, attempt an action as that agent against every
downstream system it previously had access to; confirm all are blocked,
not just the system where the violation was originally detected.
Measure the time between disable and full access halt; confirm there's
no meaningful window where the agent can still act (define "immediate"
concretely during construction and test against that definition).
Attempt to have the agent's identity silently re-enable (e.g. via a
scheduled job or automatic retry) without explicit human action; confirm
this cannot happen.
Reinstate a disabled identity via the proper manual-review flow; confirm
the reinstatement is itself audited (who, when, why).
Disable an identity that has no downstream provisioning configured yet
(edge case); confirm the system handles this gracefully rather than
erroring.