Walk allowed and denied cases
Walk both allowed and denied cases. Check direct CRUD exposure, internal calls, pages, exports, MCP tools, and replay behavior. Ask what an unauthorized caller can infer from error differences, timing, counts, or a success receipt. Verify that a hidden field is also protected in query dependencies and output projections.
Finally inspect owner invariants, locks, retention, stale versions, and external effects. A policy review is not complete if it considers only the browser. Use authentication, operation permissions, and read policies as the semantic owners.