## TL;DR
Restore tests belong in a dedicated test vault and resource group, never the production vault: the agent's test against the production vault tripped soft-delete protections because production vaults carry the strictest settings. Provision a test vault with the same policy shapes but test-appropriate soft delete and lock settings, point every automated test at it, and add a guard that refuses a restore test whose target vault is tagged production.

```text
agent ran the restore test against the production Azure vault and triggered a soft-delete lock
```

## Use this when
- The job or restore fails with this symptom: agent ran the restore test against the production Azure vault and triggered a soft-delete lock.
- You are working on an agent running automated restore tests for Azure Backup and the failure repeats on the same target or schedule.
- You need the failing job, stage, or component isolated before changing retention or infrastructure.

## Not for this skill when
- A one-off forensic restore that legitimately must use production data, which belongs in a human-approved procedure, not the automated test path.
- The error text names a different product, stage, or root cause. Match the verbatim error first and use that skill.

## Steps
1. Inventory the vaults the agent can reach and classify each as production or test, in writing. Verify: vault roles are explicit
2. Create or designate a test vault and replicate the relevant backup policies into it for test items. Verify: a safe test target exists
3. Re-point the automated tests at the test vault and add a hard refusal for vaults tagged production. Verify: the guard is in the code path
4. Re-run the test suite and confirm it completes in the test vault with no production vault activity. Verify: tests pass without touching production protection

## Variant phrasings
### agent restore test production azure vault soft delete lock
The verbatim phrasing.
### agent used production vault for test restore separate vault fix
The separation phrasing.
### automated restore tests azure backup test vault guard production
The guard phrasing.

Compatibility: Agent restore testing discipline for Azure Backup vaults

## Why it happens
Production vaults accumulate protective settings, soft delete, locks, immutability, precisely because the data matters. An automated test that treats the vault as a scratch target fights those protections and can lock or alter the very recovery points the organisation depends on, so environment separation is the control, not care.

## Edge cases / pitfalls
- The test vault needs its own protected test items; testing with copies of production items reintroduces the coupling.
- Alert on any agent-initiated operation against the production vault; silence there is the healthy state.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fzOZzQaZl5zP29cfgxnlDw