How can I verify that the agent's runtime permissions were enforced and no unauthorized data access occurred?

Catalyst embeds the effective permission set used for each step into the signed step record, including the data scope and identity claims. Auditors can compare these recorded permissions against the intended policy to spot unauthorized access. This audit depends on policy correctness and cannot catch privilege escalations outside recorded steps; it provides evidence, not prevention.