What should an API assurance record contain?
A useful record names the claim being examined, the environment and data conditions, the dependency and identity state, the action performed, the observed result and the evidence source. It also separates what was demonstrated from adjacent conditions that were not exercised.
When is additional challenge useful?
Additional challenge is most useful where a passing functional path could hide materially different behaviour: downstream failure, retries, partial completion, stale state, authorization changes, access revocation or recovery after a dependency returns.