Confirms protected mutations reject unauthenticated requests.
Built-in suites describe real checks, but no pass/fail result is claimed until a run persists evidence.