Test machine publishers through their real tools
php
dev.to
Ahnii! A machine publisher can look least-privileged on paper and still be wrong in both directions. It may carry an administrative permission it never needed, or it may fail in production because a lower-level framework check requires a capability nobody included. The useful test is not a list of permission strings. It is the real publishing workflow, executed through the same registered tools and authorization handler the machine will use in production. A recent RHT Circle publishing change