---
id: w6/m8/t006
title: "Test coverage — envtest/integration asserting the bex-api SA cannot read Secrets in auth/secrets/bex-system/argocd"
worker: worker6
status: done
estimate: 30m
depends_on: [w6/m8/t003]
---

## Objective

Add a regression test proving the RBAC boundary this milestone establishes, so a future manifest change can't silently widen it back out.

## Steps

1. Add an envtest (or equivalent) that impersonates the bex-api ServiceAccount and asserts `get secrets` in `auth`/`secrets`/`bex-system`/`argocd` is denied.
2. Add a companion test asserting it succeeds in the served namespace(s).

## Acceptance criteria

- [ ] Test fails if the RBAC boundary regresses.
- [ ] Test passes against the current state.
