01Define the boundary
Identify the actor, target resource and operation that test users is meant to govern.
02Configure the policy
Enable test-user behavior deliberately, configure deletion timing and test email domains, and keep OTP retrieval available only through controlled administrative test mechanisms. Test users should not become administrators.
03Exercise the edge cases
A CI run creates a test identity under a designated domain, reads the test OTP through the supported administrative path and allows the identity to expire automatically. Also test the path that should be denied, deferred or sent for review.
04Review the outcome
Check that the resulting state is understandable and that the decision can be investigated later. For audit-enabled operations, confirm the relevant actor and context are captured.