Controlled execution. Reproducible evidence.

01 — Authorise and prepare

Agree objectives, system ownership, third-party boundaries, test identities and representative data. Write the rules of engagement before execution. Include the environment version, communication channel and authority to pause activity.

Use seeded payments and synthetic customers with settlement disabled. Agree independent stop authority, transaction reconciliation, named system owners and permission for third-party services. Separate demonstrated draft changes from unperformed fund transfers.

02 — Model the attack path

Payment integrity needs more than a successful API call. We distinguish a changed draft, an accepted approval and a denied release, and record the controls that remain effective.

• Can an external support service expose an internal workload identity?
• Can a payment service change and approve the same seeded transaction?
• Can a supplier identity retain access to recovery management after revocation?

Use these questions to choose a realistic sequence and a bounded proof point. Explain where an assumed starting position or supplied credential will limit the conclusion.

03 — Execute and observe

Combine approved discovery with manual validation. Keep request rates and actions within the operating plan. Record successful and blocked operations with the identity and context used. Stop at agreed proof rather than expanding access simply because it is technically possible.

04 — Reconstruct the evidence

Reconcile tester observations with application, identity and defence records. Distinguish a response from a confirmed state change, a reachable host from usable authority and an assisted scenario from unaided access. Record clock differences that affect the timeline.

05 — Remediate and retest

Prioritise by the demonstrated path, reachable business operation and control context. Agree owner, due date and acceptance criteria. Separate an executed retest from a future plan, and preserve the findings that remain open.