# Test a denied deployment before a team needs an exception

A platform control should fail clearly and preserve a usable recovery path. Exercise both legitimate restrictions and accidental policy conflicts.

By Cobnex editorial. Published 2026-09-10. Updated 2026-09-11.

## Choose a specific prohibited action

Use a safe test environment and attempt an operation the baseline intentionally disallows, such as creating a resource outside an approved location or enabling an unsupported public access path.

State the expected reason for denial before running the test. A failure caused by a missing unrelated permission does not prove the intended control works.

Capture the caller identity, action and relevant policy scope without exposing credentials.

## Inspect what the team can understand

Review the error returned to the deployment pipeline. Can the workload team identify the restriction and find the relevant guidance, or does it receive only a generic access-denied message?

Check whether any resources were created before the failure. Partial deployments may need cleanup or a safe rerun path.

The test should verify that the team can recover using its normal authority. Requiring a platform administrator to manually repair every denied deployment makes the control expensive to operate.

## Test an allowed deployment beside it

Run the compliant version of the same workload. This distinguishes a useful boundary from a policy that blocks the entire capability.

Include inherited policies and identity permissions in the diagnosis. In AWS, service control policies constrain available permissions but do not grant access by themselves. An allowed action still needs the appropriate permission path.

Avoid resolving the test by broadly disabling governance. Narrow the conflicting rule or correct the workload configuration under the intended exception process.

## Exercise the exception lifecycle

Create a synthetic, time-limited exception request with an owner, reason and scope. Verify how it is approved, applied, observed and removed under the organisation's process.

Test expiry or withdrawal while the workload exists. The platform needs to explain whether existing resources remain, future changes are blocked or remediation is required.

Record the complete outcome in the platform's acceptance evidence. The control is ready when it blocks the intended action, permits the supported alternative and gives teams a practical way to resolve legitimate edge cases.

## Sources

- [AWS: service control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html)