Test access controls before relying on them.
1. Debug and release providers
A debug provider supports development and must not become the production bypass. Configure the appropriate release attestation provider and inspect token behavior on supported devices.
2. Enforcement rollout
Observe legitimate traffic before enabling enforcement, then verify invalid or missing attestation is rejected. Account for emulator and automated test environments without weakening production.
3. Abuse budgets
Set applicable project quotas and application limits. Billing alerts notify; they are not a guaranteed spending cap. Apply per-user limits at a boundary you control when the product requires them.
Worked scenario
An emulator succeeds with a registered debug token. That result does not demonstrate that a release app passes production attestation.
Apply it
Create a matrix for debug, release, missing token and invalid token requests. Record the expected and observed result.
Check your understanding
You can show a request rejected because it lacks valid app attestation. Explain the decision and show evidence from your implementation or design. If you cannot demonstrate it yet, revisit the relevant section before continuing.