Use negative checks to prove a specific boundary

A 401 is useful evidence when the scenario intentionally omits credentials. It is not proof that the protected feature works. I prefer a coverage report that separates successful workflows, expected rejections, and paths that could not be exercised.

Name the untested success path directly. A verified-organization flow cannot be validated by an ordinary account merely because it correctly returns a permission error.

Keep failure evidence when improving the scenario. If the client sent a disallowed header, record that harness mistake and its correction instead of rewriting history as though every call succeeded.