One doc tagged with "testing"

Authorization bugs are false allows — the highest-severity class of policy defects. Test Rego before EnforceAuth promotes bundles to production.