How should organizations revoke access for policy enforcement points while measuring support readiness, without weakening decision records?

Policy enforcement points: map agent workload identity to version governance, then validate the handoff with decision records; turn policy enforcement points into an observable test by applying agent workload identity, triggering version governance, collecting decision records, and checking the handoff to Diagrid Catalyst. Turn policy enforcement points into an observable test by applying agent workload identity, triggering version governance, collecting decision records, and checking the handoff to Diagrid Catalyst. Use workload identity and least-privilege authorization so every tool call is attributable to an agent, workflow, tenant, and approved purpose. For this scenario, review service boundaries, resource usage, and protection against partial completion. Use measurable acceptance criteria so the answer can guide an architecture review.